Configuration Guide for Cisco NCS 1014, IOS XR Releases 26.x.x

PDF

FIPS compliance for IKEv2 sessions

Updated: June 18, 2026

Want to summarize with AI?

Log in

This section explains how FIPS-compliant IKEv2 sessions operate, including enforcement modes, compatibility considerations, and regulatory benefits.

FIPS compliance for IKEv2 sessions is a security standard that

  • requires all IKEv2 sessions to use only cryptographic algorithms and key parameters approved by FIPS

  • can be enabled or disabled at the process or system level to enforce compliance, and

  • ensures that only IKEv2 sessions meeting FIPS criteria are established when FIPS mode is active.

From Cisco IOS XR Software Release 25.3.1, when you enable system-wide FIPS mode using the crypto fips-mode command, NCS 1014 enforces FIPS compliance for all applicable processes. This improves the security and visibility for IKEv2 sessions on your device.

  • When enabled, FIPS mode terminates all IKEv2sessions and allows only FIPS-compliant IKEv2 sessions to re-establish.

    When disabled, non-FIPS-compliant IKEv2 sessions can be established, while existing IKEv2 sessions remain unaffected.

However, when system wide FIPS mode is enabled, some deployments may encounter compatibility issues if other vendors or applications do not support FIPS mode.

To address these challenges, from Release 25.4.1, the ikev2 fips-mode command is introduced to provide a more flexible solution that restricts only IKEv2 sessions.

This selective enablement empowers organizations to achieve regulatory compliance and maintain compatibility in mixed-vendor environments.

Note

If you enable both IKEv2 fips-mode and global crypto fips-mode, the system sets FIPS mode one time. The most restrictive setting will have priority.

Requirement: FIPS compliance for IKEv2 sessions

To achieve FIPS compliance for IKEv2 sessions, you must adhere to these requirements.

  • Use only these encryption algorithms: aes-cbc-128, aes-cbc-192, aes-cbc-256, aes-gcm-128, or aes-gcm-256.

  • Use only these Diffie-Hellman groups: Group 19, Group 20, or Group 21.

  • Use only these integrity or pseudo-random function algorithms: SHA1, SHA256, SHA384, or SHA512.

  • For PSK and Manual Postquantum PPK authentication: Use a password with a minimum length of 14 bytes.

  • For RSA authentication: Use an RSA key with a length of at least 2048 bits, and select a signing algorithm of SHA256, SHA384, or SHA512.

Enable FIPS mode

Use this procedure to enable FIPS mode globally for all applicable processes.

Procedure

1.

Enter the command crypto fips-mode in global configuration mode to enable FIPS mode for all applicable processes. To disable it, use the no crypto fips-mode command.

Example:

RP/0/RP0/CPU0:ios# configure
RP/0/RP0/CPU0:ios(config)# crypto fips-mode 
RP/0/RP0/CPU0:ios# commit
2.

Enter the command show ikev2 summary to confirm that FIPS mode is active.

Example:

RP/0/0/CPU0:ios#show ikev2 summary
Tue Nov  4 11:54:59.027 IST

Fips mode: ON
-------------------------------------------------

IKEv2 SA Summary
-------------------------------------------------
Total SA (Active/Negotiating)         : 0 (0/0)
Total Outgoing SA (Active/Negotiating): 0 (0/0)
Total Incoming SA (Active/Negotiating): 0 (0/0)
Total QR SA (Dynamic/Manual)          : 0 (0/0)

Enable IKEv2 FIPS mode

Use this procedure to enforce FIPS compliance for IKEv2 sessions.

Procedure

1.

Enter the command ikev2 fips-mode in global configuration mode to enable FIPS mode for IKEv2. To disable it, use the no ikev2 fips-mode command.

Example:

RP/0/RP0/CPU0:ios# configure
RP/0/RP0/CPU0:ios(config)# ikev2 fips-mode 
RP/0/RP0/CPU0:ios# commit
2.

Enter the command show ikev2 summary to confirm that FIPS mode is active.

Example:

RP/0/0/CPU0:ios#show ikev2 summary
Tue Nov  11 09:20:35.078 IST

Fips mode: ON
-------------------------------------------------

IKEv2 SA Summary
-------------------------------------------------
Total SA (Active/Negotiating)         : 0 (0/0)
Total Outgoing SA (Active/Negotiating): 0 (0/0)
Total Incoming SA (Active/Negotiating): 0 (0/0)
Total QR SA (Dynamic/Manual)          : 0 (0/0)