close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Overview
play_arrow Configuring Administrative Credentials and Privileges
- Understanding the Associated Password Rules for an Authorized Administrator
play_arrow Configuring Roles and Authentication Methods
play_arrow Configuring SSH and Console Connection
- Configuring SSH on the Evaluated Configuration for FIPS
play_arrow Configuring MACsec
- Understanding Media Access Control Security (MACsec) in FIPS mode
- Configuring MACsec
play_arrow Configuring Event Logging
play_arrow Performing Self-Tests on a Device
- Understanding FIPS Self-Tests
- Example: Configure FIPS Self-Tests
play_arrow Operational Commands
- request system zeroize
- request vmhost zeroize no-forwarding

list Table of Contents

English

Example: Configure FIPS Self-Tests

date_range 01-Nov-21

arrow_backward

arrow_forward

This example shows how to configure FIPS self-tests to run periodically.

Hardware and Software Requirements

You must have administrative privileges to configure FIPS self-tests.
The device must be running the evaluated version of Junos OS in FIPS mode software.

Overview

The FIPS self-test consists of the following suites of known answer tests (KATs):

kernel_kats—KAT for kernel cryptographic routines
md_kats—KAT for libmd and libc
quicksec_kats—KAT for QuickSec Toolkit cryptographic implementation
openssl_kats—KAT for OpenSSL cryptographic implementation
ssh_ipsec_kats—KAT for SSH IPsec Toolkit cryptographic implementation
macsec_kats—KAT for MACsec cryptographic implementation

In this example, the FIPS self-test is executed at 9:00 AM in New York City, USA, every Wednesday.

Note:

Instead of weekly tests, you can configure monthly tests by including the month and day-of-month statements.

When a KAT self-test fails, a log message is written to the system log messages file with details of the test failure. Then the system panics and reboots.

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.

content_copy zoom_out_map
set system fips self-test periodic start-time 09:00
set system fips self-test periodic day-of-week 3

Step-by-Step Procedure

To configure the FIPS self-test, login to the device with crypto-officer credentials:

Configure the FIPS self-test to execute at 9:00 AM every Wednesday.

content_copy zoom_out_map
[edit system fips self-test]
crypto-officer@hostname:fips# set periodic start-time 09:00
crypto-officer@hostname:fips# set periodic day-of-week 3

If you are done configuring the device, commit the configuration.
```
[edit system fips self-test]
crypto-officer@hostname:fips# commit
```

Results

From configuration mode, confirm your configuration by issuing the show system command. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.

content_copy zoom_out_map
crypto-officer@hostname:fips# show system
fips {
    self-test {
        periodic {
            start-time "09:00";
            day-of-week 3;
        }
    }
}

Verification

Confirm that the configuration is working properly.

Verifying the FIPS Self-Test

Purpose
Action
Meaning

Purpose

Verify that the FIPS self-test is enabled.

Action

Run the FIPS self-test manually by issuing the request system fips self-test command or reboot the device.

After issuing the request system fips self-test command or reboot the device, the system log file is updated to display the KATs that are executed. To view the system log file, issue the file show /var/log/messages command.

content_copy zoom_out_map
user@host# file show /var/log/messages
RE KATS:
mgd: Running FIPS Self-tests
mgd: Testing kernel KATS:
mgd:   NIST 800-90 HMAC DRBG Known Answer Test:         Passed
mgd:   DES3-CBC Known Answer Test:                      Passed
mgd:   HMAC-SHA1 Known Answer Test:                     Passed
mgd:   HMAC-SHA2-256 Known Answer Test:                 Passed
mgd:   SHA-2-384 Known Answer Test:                     Passed
mgd:   SHA-2-512 Known Answer Test:                     Passed
mgd:   AES128-CMAC Known Answer Test:                   Passed
mgd:   AES-CBC Known Answer Test:                       Passed
mgd: Testing MACSec KATS:
mgd:   AES128-CMAC Known Answer Test:                   Passed
mgd:   AES256-CMAC Known Answer Test:                   Passed
mgd:   AES-ECB Known Answer Test:                       Passed
mgd:   AES-KEYWRAP Known Answer Test:                   Passed
mgd:   KBKDF Known Answer Test:                         Passed
mgd: Testing libmd KATS:
mgd:   HMAC-SHA1 Known Answer Test:                     Passed
mgd:   HMAC-SHA2-256 Known Answer Test:                 Passed
mgd:   SHA-2-512 Known Answer Test:                     Passed
mgd: Testing OpenSSL KATS:
mgd:   NIST 800-90 HMAC DRBG Known Answer Test:         Passed
mgd:   FIPS ECDSA Known Answer Test:                    Passed
mgd:   FIPS ECDH Known Answer Test:                     Passed
mgd:   FIPS RSA Known Answer Test:                      Passed
mgd:   DES3-CBC Known Answer Test:                      Passed
mgd:   HMAC-SHA1 Known Answer Test:                     Passed
mgd:   HMAC-SHA2-224 Known Answer Test:                 Passed
mgd:   HMAC-SHA2-256 Known Answer Test:                 Passed
mgd:   HMAC-SHA2-384 Known Answer Test:                 Passed
mgd:   HMAC-SHA2-512 Known Answer Test:                 Passed
mgd:   AES-CBC Known Answer Test:                       Passed
mgd:   AES-GCM Known Answer Test:                       Passed
mgd:   ECDSA-SIGN Known Answer Test:                    Passed
mgd:   KDF-IKE-V1 Known Answer Test:                    Passed
mgd:   KDF-SSH-SHA256 Known Answer Test:                Passed
mgd:   KAS-ECC-EPHEM-UNIFIED-NOKC Known Answer Test:    Passed
mgd:   KAS-FFC-EPHEM-NOKC Known Answer Test:            Passed
mgd: Testing QuickSec 7.0 KATS:
mgd:   NIST 800-90 HMAC DRBG Known Answer Test:         Passed
mgd:   DES3-CBC Known Answer Test:                      Passed
mgd:   HMAC-SHA1 Known Answer Test:                     Passed
mgd:   HMAC-SHA2-224 Known Answer Test:                 Passed
mgd:   HMAC-SHA2-256 Known Answer Test:                 Passed
mgd:   HMAC-SHA2-384 Known Answer Test:                 Passed
mgd:   HMAC-SHA2-512 Known Answer Test:                 Passed
mgd:   AES-CBC Known Answer Test:                       Passed
mgd:   AES-GCM Known Answer Test:                       Passed
mgd:   SSH-RSA-ENC Known Answer Test:                   Passed
mgd:   SSH-RSA-SIGN Known Answer Test:                  Passed
mgd:   SSH-ECDSA-SIGN Known Answer Test:                Passed
mgd:   KDF-IKE-V1 Known Answer Test:                    Passed
mgd:   KDF-IKE-V2 Known Answer Test:                    Passed
mgd: Testing QuickSec KATS:
mgd:   NIST 800-90 HMAC DRBG Known Answer Test:         Passed
mgd:   DES3-CBC Known Answer Test:                      Passed
mgd:   HMAC-SHA1 Known Answer Test:                     Passed
mgd:   HMAC-SHA2-224 Known Answer Test:                 Passed
mgd:   HMAC-SHA2-256 Known Answer Test:                 Passed
mgd:   HMAC-SHA2-384 Known Answer Test:                 Passed
mgd:   HMAC-SHA2-512 Known Answer Test:                 Passed
mgd:   AES-CBC Known Answer Test:                       Passed
mgd:   AES-GCM Known Answer Test:                       Passed
mgd:   SSH-RSA-ENC Known Answer Test:                   Passed
mgd:   SSH-RSA-SIGN Known Answer Test:                  Passed
mgd:   KDF-IKE-V1 Known Answer Test:                    Passed
mgd:   KDF-IKE-V2 Known Answer Test:                    Passed
mgd: Testing SSH IPsec KATS:
mgd:   NIST 800-90 HMAC DRBG Known Answer Test:         Passed
mgd:   DES3-CBC Known Answer Test:                      Passed
mgd:   HMAC-SHA1 Known Answer Test:                     Passed
mgd:   HMAC-SHA2-256 Known Answer Test:                 Passed
mgd:   AES-CBC Known Answer Test:                       Passed
mgd:   SSH-RSA-ENC Known Answer Test:                   Passed
mgd:   SSH-RSA-SIGN Known Answer Test:                  Passed
mgd:   KDF-IKE-V1 Known Answer Test:                    Passed
mgd: Testing file integrity:
mgd:   File integrity Known Answer Test:                Passed
mgd: Testing crypto integrity:
mgd:   Crypto integrity Known Answer Test:              Passed
mgd: Expect an exec AuthenticatiMAC/veriexec: no fingerprint (file=/sbin/kats/cannot-exec fsid=246 fileid=49356 gen=1 uid=0 pid=9384 ppid=9354 gppid=9352)on error...
mgd: /sbin/kats/run-tests: /sbin/kats/cannot-exec: Authentication error
mgd: FIPS Self-tests Passed

LC KATS:

Sep 12 10:50:44  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/0:0: <LC: Slot no> pic:0 port:0 chan:0 FIPS AES-256-GCM MACsec KATS encryption passed
Sep 12 10:50:50  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/1:0: <LC: Slot no> pic:0 port:1 chan:0 FIPS AES-256-GCM MACsec KATS encryption passed
Sep 12 10:50:55  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/0:0: <LC: Slot no> pic:0 port:0 chan:0 FIPS AES-256-GCM MACsec KATS decryption passed
Sep 12 10:50:56  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/2:0: <LC: Slot no> pic:0 port:2 chan:0 FIPS AES-256-GCM MACsec KATS encryption passed
Sep 12 10:51:01  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/1:0: <LC: Slot no> pic:0 port:1 chan:0 FIPS AES-256-GCM MACsec KATS decryption passed
Sep 12 10:51:02  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/2:0: <LC: Slot no> pic:0 port:2 chan:0 FIPS AES-256-GCM MACsec KATS decryption passed
Sep 12 10:51:06  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/3:0: <LC: Slot no> pic:0 port:3 chan:0 FIPS AES-256-GCM MACsec KATS encryption passed
Sep 12 10:51:12  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/3:0: <LC: Slot no> pic:0 port:3 chan:0 FIPS AES-256-GCM MACsec KATS decryption passed
Sep 12 10:51:17  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/4:0: <LC: Slot no> pic:0 port:4 chan:0 FIPS AES-256-GCM MACsec KATS encryption passed
Sep 12 10:51:17  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/4:0: <LC: Slot no> pic:0 port:4 chan:0 FIPS AES-256-GCM MACsec KATS decryption passed
Sep 12 10:51:26  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/5:0: <LC: Slot no> pic:0 port:5 chan:0 FIPS AES-256-GCM MACsec KATS encryption passed
Sep 12 10:51:27  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/5:0: <LC: Slot no> pic:0 port:5 chan:0 FIPS AES-256-GCM MACsec KATS decryption passed
Sep 12 10:51:36  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/6:0: <LC: Slot no> pic:0 port:6 chan:0 FIPS AES-256-GCM MACsec KATS encryption passed
Sep 12 10:51:36  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/6:0: <LC: Slot no> pic:0 port:6 chan:0 FIPS AES-256-GCM MACsec KATS decryption passed
Sep 12 10:51:44  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/7:0: <LC: Slot no> pic:0 port:7 chan:0 FIPS AES-256-GCM MACsec KATS encryption passed
Sep 12 10:51:44  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/7:0: <LC: Slot no> pic:0 port:7 chan:0 FIPS AES-256-GCM MACsec KATS decryption passed
Sep 12 10:51:51  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/8:0: <LC: Slot no> pic:0 port:8 chan:0 FIPS AES-256-GCM MACsec KATS encryption passed
Sep 12 10:51:51  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/8:0: <LC: Slot no> pic:0 port:8 chan:0 FIPS AES-256-GCM MACsec KATS decryption passed
Sep 12 10:51:58  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/9:0: <LC: Slot no> pic:0 port:9 chan:0 FIPS AES-256-GCM MACsec KATS encryption passed
Sep 12 10:51:58  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/9:0: <LC: Slot no> pic:0 port:9 chan:0 FIPS AES-256-GCM MACsec KATS decryption passed
Sep 12 10:52:05  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/10:0: <LC: Slot no> pic:0 port:10 chan:0 FIPS AES-256-GCM MACsec KATS encryption passed
Sep 12 10:52:05  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/10:0: <LC: Slot no> pic:0 port:10 chan:0 FIPS AES-256-GCM MACsec KATS decryption passed
Sep 12 10:52:12  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/11:0: <LC: Slot no> pic:0 port:11 chan:0 FIPS AES-256-GCM MACsec KATS encryption passed
Sep 12 10:52:12  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/0/11:0: <LC: Slot no> pic:0 port:11 chan:0 FIPS AES-256-GCM MACsec KATS decryption passed
Sep 12 10:52:20  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/1/0:0: <LC: Slot no> pic:1 port:0 chan:0 FIPS AES-256-GCM MACsec KATS encryption passed
Sep 12 10:52:20  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/1/0:0: <LC: Slot no> pic:1 port:0 chan:0 FIPS AES-256-GCM MACsec KATS decryption passed
Sep 12 10:52:27  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/1/1:0: <LC: Slot no> pic:1 port:1 chan:0 FIPS AES-256-GCM MACsec KATS encryption passed
Sep 12 10:52:28  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/1/1:0: <LC: Slot no> pic:1 port:1 chan:0 FIPS AES-256-GCM MACsec KATS decryption passed
Sep 12 10:52:34  <DUT-NAME> <LC slot> network_macsec_kats_input xe-<LC slot no>/1/2:0: <LC: Slot no> pic:1 port:2 chan:0 FIPS AES-256-GCM MACsec KATS encryption passed

Meaning

The system log file displays the date and the time at which the KATs were executed and their status.

arrow_backward PREVIOUS Understanding FIPS Self-Tests

NEXT arrow_forward request system zeroize

FIPS Evaluated Configuration Guide for MX2010 and MX2020 Devices

ON THIS PAGE