HP VPN Firewall Appliances Access Control Command Reference

257
FIPS configuration commands
Feature and hardware compatibility
fips mode enable
Syntax
fips mode enable
undo fips mode enable
View
System view
Default level
2: System level
Parameters
None
Description
Use the fips mode enable command to enable FIPS mode.
Use the undo fips mode enable command to disable FIPS mode.
By default, the FIPS mode is disabled.
The FIPS mode complies with FIPS 140-2.
The way for using FIPS mode:
• Delete all MD5-based digital certificates
• Delete the DSA key pairs that have a modulus length of less than 1024 bits and all RSA key pairs.
• Enable FIPS mode.
• Enable password-control function.
• Configure the login user name and password. The password must comprise no less than 8
characters and must contain uppercase and lowercase letters, digits, and special characters. You
can use the password-control functions to manage and protect the password.
• Configure the login user service-type.
Save the configuration and reboot the device. After the reboot, the device is working in FIPS 140-2 mode.
In CC certificate, this is equal to work according to CC standard.
After you enable FIPS mode and restart the device, the following changes occur:
• The FTP/TFTP server is disabled.
• The Telnet server is disabled.
• The HTTP server is disabled.
• SNMP v1 and SNMP v2c are disabled. Only SNMP v3 is available.