System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Cryptographic services in FIPS mode

Updated: September 18, 2026

Want to summarize with AI?

Log in

Explains how key chains, certificates, OSPFv3, and SNMPv3 use documented cryptographic algorithms and key material after FIPS mode is enabled.

Cryptographic services in FIPS mode are router functions that

  • use documented cryptographic algorithms and key material

  • protect authentication, certificate, routing, and management operations, and

  • must meet the applicable FIPS mode requirements before they can operate successfully.

Enable FIPS mode before configuring the service-specific key chain, certificate, OSPFv3, or SNMPv3 settings.

Uses of cryptographic services

Table 1. Service-specific cryptographic uses

Service or component

Cryptographic use

Key chain

Authenticates application sessions with a configured hash or HMAC algorithm.

Certificate

Associates a certificate trustpoint with cryptographic keys and the required signature-hash or encryption type.

OSPFv3

Uses IPsec authentication and encryption to protect routing packets.

SNMPv3

Uses authentication and privacy algorithms to protect management access.

Configure a FIPS-compliant key chain

Create a key chain that uses a documented FIPS-mode algorithm.

Applications such as routing protocols can use key chains to authenticate protocol sessions.

Before you begin

Enable FIPS mode and ensure that an HMAC-SHA key string contains at least 14 characters.

Procedure

Create the key chain and key in global configuration mode and select its cryptographic algorithm.

Example:

Router# configure
Router(config)# key chain sample-keychain
Router(config-sample-keychain)# key 1
Router(config-sample-keychain-1)# cryptographic-algorithm HMAC-SHA1-20
Router(config-sample-keychain-1)# commit

You may choose from these cryptographic algorithms: HMAC-SHA1-20 or SHA-1 .

The key chain uses the selected documented FIPS-mode algorithm.

Configure FIPS-compliant certificates

Configures a trustpoint with an RSA key and verifies the certificate information on the router.

The trustpoint associates certificate authority information with the cryptographic key used by the router.

Before you begin

  • Enable FIPS mode.

  • Generate the required RSA key pair.

  • Ensure that certificates meet the FIPS requirements for key length, signature hash, and encryption type.

  • Use a minimum RSA or DSA key length of 1024 bits and the SHA-1-20 hash algorithm.

Procedure

  1. Associate the trustpoint with the RSA key in global configuration mode, and commit the configuration.

    Example:

    Router# configure
Router(config)# crypto ca trustpoint sample-trustpoint sample-rsa-keypair
Router(config)# commit

  2. Display the certificate information.

    Example:

    Router# show crypto ca certificates

Configure FIPS-compliant OSPFv3

Protect OSPFv3 packets with documented authentication and encryption algorithms.

Before you begin

Enable FIPS mode.

Procedure

Configure the OSPFv3 process, area authentication, and process encryption in global configuration mode.

Example:

Router# configure
Router(config)# router ospfv3 sample-ospfv3
Router(config-ospfv3)# area 1
Router(config-ospfv3-ar)# authentication ipsec spi 256 sha1 password sample-auth-password
Router(config-ospfv3-ar)# exit
Router(config-ospfv3)# encryption ipsec spi 256 esp 3des password sample-encryption-password
Router(config-ospfv3)# commit

  • The area ID can be a decimal value or an IP address.

  • OSPFv3 supports only SHA-1 for authentication.

  • IPsec support applies only to OSPFv3.

  • For encryption, use 3DES or AES with an optional 192-bit or 256-bit key. Select SHA-1 when you enable authentication.

The OSPFv3 process protects routing packets with the configured authentication and encryption settings.

Configure a FIPS-compliant SNMPv3 server

Configure secure SNMPv3 authentication and privacy for a server user.

SNMPv3 separates user authentication from privacy encryption in the server-user configuration.

Before you begin

Enable FIPS mode.

Procedure

Configure the SNMPv3 user in global configuration mode, and commit the configuration.

Example:

Router# configure
Router(config)# snmp-server user sample-snmp-user sample-snmp-group v3 auth sha clear sample-auth-password priv aes 128 clear sample-privacy-password
Router(config)# commit

The command supports SHA authentication and 3DES or AES privacy. AES privacy supports 128-bit, 192-bit, or 256-bit keys.

The SNMPv3 server user uses the configured authentication and privacy protection.