Users Guide

crypto fips enable
Enables FIPS mode.
Syntax
crypto fips enable
Parameters None
Default Not configured
Command mode EXEC
Usage
information
You can use OS10 in FIPS 140-2 compliant mode. In this mode, applications restrict their use of
cryptographic algorithms to those supported by the NIST FIPS 140-2 standard and certification process.
When you enable FIPS mode:
● The SSH service restarts. Existing SSH sessions are not affected. Only new SSH sessions operate in
the enabled FIPS mode.
● SSH host keys are regenerated.
● If SNMPv3 is configured with privacy settings, it operates in FIPS mode.
If you enable FIPS using the crypto fips enable command, RADIUS over TLS operates in FIPS
mode. In FIPS mode, RADIUS over TLS requires that a FIPS-compliant certificate and key pair are
installed on the switch.
Example
OS10# crypto fips enable
Supported
releases
10.4.3.0 or later
crypto security-profile
Creates an application-specific security profile.
Syntax
crypto security-profile profile-name
Parameters profile-name — Enter the name of the security profile; a maximum of 32 characters.
Default Not configured
Command mode CONFIGURATION
Usage
information
Create a security profile for a specific application on the switch, such as RADIUS over TLS. A security
profile associates a certificate and private key pair using the certificate command. The no form of
the command deletes the security profile.
Example
OS10# crypto security-profile secure-radius-profile
OS10(config-sec-profile)#
Supported
releases
10.4.3.0 or later
peer-name-check
Enables peer name checking in a security profile for certificates presented by external devices.
Syntax
peer-name-check
Parameters None
Default Not configured
Command mode SEC-PROFILE
Usage
information
Use the peer-name-check command to enable an OS10 application to verify that the certificate used
to connect to the switch matches the name of the peer device, such as a remote server name. The no
version of the command disables peer name checking in the security profile.
1384 Security