Enabling FIPS Mode

date_range 07-Sep-22

arrow_backward

arrow_forward

FIPS mode is not automatically enabled when you install Junos OS on the switch.

As Crypto Officer, you must explicitly enable FIPS mode on the switch by setting the FIPS level to 1 (one), the FIPS 140-2 level at which EX Series switches and QFX Series switches are certified. A switch on which FIPS mode is not enabled has a FIPS level of 0 (zero).

Note:

To transition to FIPS mode, passwords must be encrypted with a FIPS-compliant hash algorithm. Passwords that do not meet this requirement, such as passwords that are hashed with MD5, must be reconfigured or removed from the configuration before FIPS mode can be enabled.

To enable FIPS mode in Junos OS on the switch:

Zeroize the switch to delete all CSPs before entering FIPS mode.
After the switch comes up in Amnesiac mode, login using console with username root and password (blank).
```
login :root
Password:

--- JUNOS 20.2R1-20200516 built 2020-05-29 04:12:22 UTCroot@:~ # cli
root>
```

Configure root authentication with password at least 10 characters or more.

content_copy zoom_out_map
root@switch> edit
Entering configuration mode

[edit]root@switch# set system root-authentication plain-text-password
New password:
Retype new password:
root@switch# commit
configuration check succeeds commit complete

Load configuration to switch and commit new configuration.
Configure Crypto Officer and login with Crypto Officer credentials.
Configure chassis boundary fips by setting the set system fips level 1 command followed by the commit command.

Note:
The device might display warnings to delete older CSPs in loaded configuration- Encrypted-password must be re-configured to use FIPS compliant hash.

After deleting and reconfiguring the CSPs, commit is successful and the switch needs reboot to enter FIPS mode.

content_copy zoom_out_map
crypto-officer@switch# commit
configuration check succeeds
[edit]
  'system'
    warning: reboot is required to transition to FIPS level 1
commit complete
[edit]
crypto-officer@switch# run request system reboot

After rebooting the switch, FIPS self-tests will run and switch enters FIPS mode.
```
crypto-officer@switch:fips>
```

Note:

Use local keyword for operational commands in FIPS mode. For example, show version local, and show system uptime local.

arrow_backward PREVIOUS Zeroizing the System

NEXT arrow_forward Configuring Crypto Officer and FIPS User Identification and Access

FIPS Evaluated Configuration Guide for QFX5120-32C, QFX5120-48T, QFX5120-48Y, QFX5210-64C, and EX4650-48Y Devices

Enabling FIPS Mode

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry