Users Guide

Fabric OS Administrator’s Guide 647
53-1002920-02
FIPS mode configuration
B
Power-on self-tests
A power-on self-test (POST) is invoked by powering on the switch in FIPS mode and does not require
any operator intervention. If any KATs fail, the switch goes into a FIPS Error state, which reboots the
system to start the test again. If the switch continues to fail the FIPS POST, you will need to return
your switch to your switch service provider for repair. Refer to the Fabric OS Troubleshooting and
Diagnostics Guide for information about preparing a case for your service provider.
Conditional tests
These tests are for the random number generators and are executed to verify the randomness of
the random number generator. The conditional tests are executed each time prior to using the
random number provided by the random number generator.
The results of the POST and conditional tests are recorded in the system log or are output to the
local console. This action includes logging both passing and failing results. Refer to the Fabric OS
Troubleshooting and Diagnostics Guide for instructions on how to recover if your system cannot get
out of the conditional test mode.
FIPS mode configuration
By default, the switch comes up in non-FIPS mode. You can run the fipsCfg --enable fips command
to enable FIPS mode, but you must configure the switch first. Self-test mode must be enabled
before FIPS mode can be enabled. A set of prerequisites (as shown in Table 96) must be satisfied
for the system to enter FIPS mode. To be FIPS-compliant, the switch must be power-cycled. KATs are
run on the reboot. If the KATs are successful, the switch enters FIPS mode. If the KATs fail, then the
switch reboots until the KATs succeed. If the switch cannot enter FIPS mode and continues to
reboot, you must return the switch to your switch service provider. For information about how to
prepare a service provider case, refer to the Fabric OS Troubleshooting and Diagnostics Guide.
When the switch successfully reboots in FIPS mode, only FIPS-compliant algorithms are run.
NOTE
RPC is not supported in FIPS mode.
Table 96 lists Fabric OS features and their behaviors in FIPS and non-FIPS mode.
TABLE 96 FIPS mode restrictions
Features FIPS mode Non-FIPS mode
Authentication All ports, including Access Gateway, FC
router, and F_Ports, adhere to FIPS
guidelines when authentication is enabled.
No restrictions.
Configupload/ download/
supportsave/ firmwaredownload
SCP only FTP and SCP
DH-CHAP/FCAP
hashing algorithms
SHA-1 MD5 and SHA-1
DH-CHAP Shared Secret Minimum length of 32 bytes for secret used
in in-flight encryption
Minimum length of 8 bytes for
secret