- play_arrow Overview
- play_arrow Configuring Administrative Credentials and Privileges
- play_arrow Configuring Roles and Authentication Methods
- Understanding Roles and Services for Junos OS
- Understanding the Operational Environment for Junos OS in FIPS Mode
- Understanding Password Specifications and Guidelines for Junos OS in FIPS Mode
- Downloading Software Packages from Juniper Networks
- Installing Software on a Device with Single Routing Engine
- Understanding Zeroization to Clear System Data for FIPS Mode
- Zeroizing the System
- Enabling FIPS Mode
- Configuring Crypto Officer and FIPS User Identification and Access
- play_arrow Configuring SSH and Console Connection
- play_arrow Configuring MACsec
- play_arrow Configuring Event Logging
- play_arrow Operational Commands
Understanding FIPS Self-Tests
The cryptographic module enforces security rules to ensure that the Juniper Networks Junos operating system (Junos OS) in FIPS mode meets the security requirements of FIPS 140-2 Level 1. To validate the output of cryptographic algorithms approved for FIPS and test the integrity of some system modules, the device performs the following series of known answer test (KAT) self-tests:
kernel_kats—KAT for kernel cryptographic routinesmd_kats—KAT for libmd and libcopenssl_kats—KAT for OpenSSL cryptographic implementationquicksec_kats—KAT for QuickSec Toolkit cryptographic implementationssh_ipsec_kats—KAT for SSH IPsec Toolkit cryptographic implementationmacsec_kats—KAT for MACsec cryptographic implementation
The KAT self-tests are performed automatically at startup. Conditional self-tests are also performed automatically to verify digitally signed software packages, generated random numbers, RSA and ECDSA key pairs, and manually entered keys.
If the KATs are completed successfully, the system log (syslog) file is updated to display the tests that were executed.
If there is KAT failure, the device writes the details to a system log file, enters FIPS error state (panic) and reboots.
The file show /var/log/messages command displays the system
log.
You can also run FIPS self-test by issuing request
vmhost reboot command for REMX2K-X8 and request
system reboot command for RE1800. You can see the FIPS
self-test logs on the console when the system is coming up.
