When Junos OS is installed on NFX350 device and the device
is powered on, it is ready to be configured. Initially, you log in
as the user root with no password. When you log in as root, your SSH connection is enabled by default.
As Crypto Officer, you must establish a root password conforming to the FIPS password
requirements in Understanding Password Specifications and Guidelines for Junos OS in FIPS Mode. When you enable
FIPS mode in Junos OS on the device, you cannot configure passwords unless they meet
this standard.
Local passwords are encrypted with the secure hash
algorithm SHA256 or SHA512. Password recovery is not possible in Junos
OS in FIPS mode. Junos OS in FIPS mode cannot boot into single-user
mode without the correct root password.
To enable FIPS mode in Junos OS on the device:
- Zeroize the device to delete all CSPs before
entering FIPS mode. Refer to Understanding Zeroization to Clear System Data for FIPS Mode
section for details.
- After the device comes up in ’Amnesiac mode’,
login using username
root and password "" (blank).content_copy zoom_out_map
FreeBSD/amd64 (Amnesiac) (ttyu0)
login: root
--- JUNOS 20.3R3.7 Kernel 64-bit JNPR-11.0-20200908.87c9d89_builroot@:~ # cli
root>
- Configure root authentication.
content_copy zoom_out_map
root> edit
Entering configuration mode
[edit]
root# set system root-authentication plain-text-password
New password:
Retype new password:
[edit]
root# commit
commit complete
- Load configuration onto device and commit new configuration.
- The fips-mode and jpfe-fips are optional packages needed
for enabling FIPS. These packages are part of Junos OS software. To
enable these packages, use below commands:
content_copy zoom_out_map
root@hostname> request vmhost software add optional://fips-mode.tgz
Verified fips-mode signed by PackageDevelopmentEc_2019 method ECDSA256+SHA256
content_copy zoom_out_map
root@hostname> request vmhost software add optional://jpfe-fips.tgz
Verified jpfe-fips signed by PackageDevelopmentEc_2019 method ECDSA256+SHA256
Device might display the Encrypted-password must be re-configured
to use FIPS compliant hash warning to delete older CSP in loaded
configuration.
- After deleting and reconfiguring CSPs, commit will go
through and device needs reboot to enter FIPS mode.
content_copy zoom_out_map
[edit]
root@hostname# commit
Generating RSA key /etc/ssh/fips_ssh_host_key
Generating RSA2 key /etc/ssh/fips_ssh_host_rsa_key
Generating ECDSA key /etc/ssh/fips_ssh_host_ecdsa_key[edit]
system
reboot is required to transition to FIPS level 1
commit complete
Reboot the device by issuing request vmhost reboot
content_copy zoom_out_map
root@hostname# request vmhost reboot
- After rebooting the device, FIPS self-tests will run and
device enters FIPS mode.
content_copy zoom_out_map
- After the reboot has completed, log in and use the
show version command to verify.content_copy zoom_out_map
root@hostname:fips> show version
Model: nfx350_s1
Junos: 20.3R3.7
JUNOS OS Kernel 64-bit [20200908.87c9d89_builder_stable_11]
JUNOS OS libs [20200908.87c9d89_builder_stable_11]
JUNOS OS runtime [20200908.87c9d89_builder_stable_11]
JUNOS OS time zone information [20200908.87c9d89_builder_stable_11]
JUNOS network stack and utilities [20200917.061621_builder_junos_203_r3]
JUNOS libs [20200917.061621_builder_junos_203_r3]
JUNOS OS libs compat32 [20200908.87c9d89_builder_stable_11]
JUNOS OS 32-bit compatibility [20200908.87c9d89_builder_stable_11]
JUNOS libs compat32 [20200917.061621_builder_junos_203_r3]
JUNOS runtime [20200917.061621_builder_junos_203_r3]
JUNOS Packet Forwarding Engine Simulation Package [20200917.061621_builder_junos_203_r3]
JUNOS sflow mx [20200917.061621_builder_junos_203_r3]
JUNOS py extensions2 [20200917.061621_builder_junos_203_r3]
JUNOS py extensions [20200917.061621_builder_junos_203_r3]
JUNOS py base2 [20200917.061621_builder_junos_203_r3]
JUNOS py base [20200917.061621_builder_junos_203_r3]
JUNOS OS vmguest [20200908.87c9d89_builder_stable_11]
JUNOS OS crypto [20200908.87c9d89_builder_stable_11]
JUNOS OS boot-ve files [20200908.87c9d89_builder_stable_11]
JUNOS na telemetry [20.3R3.7]
JUNOS Wireless WAN Module [20200917.061621_builder_junos_203_r3]
Junos vmguest package [20200917.061621_builder_junos_203_r3]
JUNOS Unified Threat Management Module [20200917.061621_builder_junos_203_r3]
JUNOS userfw [20200917.061621_builder_junos_203_r3]
JUNOS syshmd [20200917.061621_builder_junos_203_r3]
JUNOS switch CLI for NFX-3 [20200917.061621_builder_junos_203_r3]
JUNOS security base [20200917.061621_builder_junos_203_r3]
JUNOS mx libs compat32 [20200917.061621_builder_junos_203_r3]
JUNOS mx runtime [20200917.061621_builder_junos_203_r3]
JUNOS RPD Telemetry Application [20.3R3.7]
Redis [20200917.061621_builder_junos_203_r3]
JUNOS probe utility [20200917.061621_builder_junos_203_r3]
JUNOS pppoe [20200917.061621_builder_junos_203_r3]
JUNOS common platform support [20200917.061621_builder_junos_203_r3]
JUNOS nfx platform support [20200917.061621_builder_junos_203_r3]
JUNOS Openconfig [20.3R3.7]
JUNOS mtx network modules [20200917.061621_builder_junos_203_r3]
JUNOS named module [20200917.061621_builder_junos_203_r3]
JUNOS modules [20200917.061621_builder_junos_203_r3]
JUNOS mx modules [20200917.061621_builder_junos_203_r3]
JUNOS mx libs [20200917.061621_builder_junos_203_r3]
JUNOS SQL Sync Daemon [20200917.061621_builder_junos_203_r3]
JUNOS jdm ure cmd [20200917.061621_builder_junos_203_r3]
JUNOS jdm cmd [20200917.061621_builder_junos_203_r3]
JUNOS Security Intelligence [20200917.061621_builder_junos_203_r3]
JUNOS nfx Data Plane Crypto Support [20200917.061621_builder_junos_203_r3]
JUNOS ike [20200917.061621_builder_junos_203_r3]
JUNOS idpd64 [20200917.061621_builder_junos_203_r3]
JUNOS idpd [20200917.061621_builder_junos_203_r3]
JUNOS Web management gatekeeper module [20200917.061621_builder_junos_203_r3]
JUNOS High Availability [20200917.061621_builder_junos_203_r3]
JUNOS Firewall Authentication[20200917.061621_builder_junos_203_r3]
JUNOS daemons [20200917.061621_builder_junos_203_r3]
JUNOS mx daemons [20200917.061621_builder_junos_203_r3]
JUNOS appidd-srx application-identification daemon [20200917.061621_builder_junos_203_r3]
JUNOS Advanced Anti-Malware [20200917.061621_builder_junos_203_r3]
JUNOS Services URL Filter package [20200917.061621_builder_junos_203_r3]
JUNOS Services TLB Service PIC package [20200917.061621_builder_junos_203_r3]
JUNOS Services Telemetry [20200917.061621_builder_junos_203_r3]
JUNOS Services TCP-LOG [20200917.061621_builder_junos_203_r3]
JUNOS Services SSL [20200917.061621_builder_junos_203_r3]
JUNOS Services SOFTWIRE [20200917.061621_builder_junos_203_r3]
JUNOS Services Stateful Firewall [20200917.061621_builder_junos_203_r3]
JUNOS Services RTCOM [20200917.061621_builder_junos_203_r3]
JUNOS Services RPM [20200917.061621_builder_junos_203_r3]
JUNOS Services PCEF package [20200917.061621_builder_junos_203_r3]
JUNOS Services NAT [20200917.061621_builder_junos_203_r3]
JUNOS Services Mobile Subscriber Service Container package [20200917.061621_builder_junos_203_r3]
JUNOS Services MobileNext Software package [20200917.061621_builder_junos_203_r3]
JUNOS Services Logging Report Framework package [20200917.061621_builder_junos_203_r3]
JUNOS Services LL-PDF Container package [20200917.061621_builder_junos_203_r3]
JUNOS Services Jflow Container package [20200917.061621_builder_junos_203_r3]
JUNOS Services Deep Packet Inspection package [20200917.061621_builder_junos_203_r3]
JUNOS Services IPSec [20200917.061621_builder_junos_203_r3]
JUNOS Services IDS [20200917.061621_builder_junos_203_r3]
JUNOS IDP Services [20200917.061621_builder_junos_203_r3]
JUNOS Services HTTP Content Management package [20200917.061621_builder_junos_203_r3]
JUNOS Services Crypto [20200917.061621_builder_junos_203_r3]
JUNOS Services Captive Portal and Content Delivery Container package [20200917.061621_builder_junos_203_r3]
JUNOS Services COS [20200917.061621_builder_junos_203_r3]
JUNOS AppId Services [20200917.061621_builder_junos_203_r3]
JUNOS Services Application Level Gateways [20200917.061621_builder_junos_203_r3]
JUNOS Services AACL Container package [20200917.061621_builder_junos_203_r3]
JUNOS SDN Software Suite [20200917.061621_builder_junos_203_r3]
JUNOS Extension Toolkit [20200917.061621_builder_junos_203_r3]
JUNOS Phone-home [20200917.061621_builder_junos_203_r3]
JUNOS FXPC Package [20200917.061621_builder_junos_203_r3]
JUNOS Packet Forwarding Engine FIPS Support [20.3R3.7]
JUNOS Juniper Malware Removal Tool (JMRT) [1.0.0+20200917.061621_builder_junos_203_r3]
JUNOS J-Insight [20200917.061621_builder_junos_203_r3]
JUNOS Online Documentation [20200917.061621_builder_junos_203_r3]
JUNOS jail runtime [20200908.87c9d89_builder_stable_11]
JUNOS FIPS mode utilities [20200917.061621_builder_junos_203_r3]
