Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Enabling FIPS Mode

FIPS mode is not automatically enabled when you install Junos OS on the device.

As Security Administrator, you must explicitly enable FIPS mode on the device by setting the FIPS level to 1 (one), the FIPS 140-3 level at which the devices are certified. A device on which FIPS mode is not enabled has a FIPS level of 0 (zero).

Note:

To transition to FIPS mode, passwords must be encrypted with a FIPS-compliant hash algorithm. The encryption format must be SHA-256 or higher. Passwords that do not meet this requirement, such as passwords that are hashed with MD5, must be reconfigured or removed from the configuration before FIPS mode can be enabled.

To enable FIPS mode in Junos OS on the device:

  1. The fips-mode.tgz is an optional package needed for enabling FIPS. This package is part of Junos OS software. To enable this package, use below command:
  2. Enter configuration mode:
  3. Configure the root authentication.
  4. Enable FIPS mode on the switch by setting the FIPS level to 1, and verify the level:
  5. Commit the configuration:
    Note:

    If the switch terminal displays error messages about the presence of critical security parameters (CSPs), delete those CSPs, and then commit the configuration.

  6. Reboot the device:

    During the reboot, the device runs Known Answer Tests (KATS). It returns a login prompt:

    Log in to the device. The CLI displays a banner that is followed by a prompt that includes “:fips”:

  7. After the reboot has completed, log in and use the show version local command to verify.
Note:

Use “local” keyword for operational commands in FIPS mode. For example, show version local and show system uptime local.