FIPS Mode on Cisco NFVIS

FIPS mode on NFVIS

FIPS mode on NFVIS is a security compliance mechanism that

  • implements Federal Information Processing Standards (FIPS) Publication 140-3 for United States federal government and contractor use

  • attempts to prevent the use of non-FIPS compatible algorithms on the device, and

  • requires manual configuration to ensure only FIPS approved algorithms are used.

FIPS mode behavior

In FIPS mode, certain functions may fail silently if they attempt to use non-compliant algorithms. You must ensure that the device is configured to use only FIPS-approved algorithms. FIPS mode is enabled by default on BExK platforms.

Disable FIPS mode

To disable FIPS mode, you must first perform a factory reset. After the reset, disable FIPS mode and reboot the device. The same steps apply when re-enabling FIPS mode.

Configure FIPS mode

FIPS mode enables FIPS 140-3 compliant operation for SSH, TLS and SNMP protocols on NFVIS.

NFVIS supports both FIPS and non-FIPS mode of operation. FIPS mode configuration settings for NFVIS, highlighting the protocols affected and compatibility notes for Cisco Catalyst 8000V devices.

Before you begin

Ensure that SNMP v1, v2, or v3 with MD5 auth protocol is not configured, as FIPS mode configuration will be terminated if these are present.

Procedure

Step 1

Enable FIPS mode.

Example:


config terminal
security fips
commit

Only after NFVIS reboot after the configuration FIPS mode is enabled.

FIPS mode can be disabled only with factory reset. If you try to disable FIPS mode with the no form of the command:

Example:


config terminal
no security fips
commit
Aborted: This command can only be removed while factory reset

Example:

The following is an example, where FIPS mode is successfully configured, but not enabled:


nfvis# show security
security fips-status CONFIGURED_REBOOT_TO_ENABLE

Step 2

Verify the status of the FIPS mode after reboot:

Example:


nfvis# show security
security fips-status ENABLED

FIPS mode configuration is terminated when:

  • SNMP v1 or v2 is configured.

    The following is an example of FIPS mode configuration failure when SNMP v1 or v2 is configured:

    
config terminal
security fips
commit
Aborted: SNMP version 1 and/or SNMP version 2 is configure. Please unconfigure SNMPv1 and SNMPv2 and then try again

  • SNMP v3 is configured with auth protocol MD5.

    The following is an example of FIPS mode configuration failure when SNMP v3 is configured with auth protocol md5:

    
config terminal
security fips
commit
Aborted: SNMP version 3 MD5 auth-protocol configured other secure protocol and try again

Note

 

After FIPS mode is enabled, SNMP v1or v2 and SNMP v3 with auth protocol MD5 cannot be configured.


snmp group test_v1 snmp 1 noAuthNoPriv read test write test
commit
Aborted: Cannot configure SNMP group-version 1 because fips-status is ENABLED


config terminal
snmp user test_md5_v3
    user-version  3
    user-group test_v3
    auth-protocol md5
    auth-key 46:97:c3:b0:ba:45:fd:5e:be:99:44:c5:64:c9:bc:44
    commit
Aborted: 'snmp user test_md5_v3_passhd auth-protocol': Cannot configure SNMP user-version 3 with auth-protocol MD5 because fips-status is CONFIGURED_REBOOT_TO_ENABLE
nfvis(config-user-test_md5_v3_passhd)#

FIPS mode is enabled and NFVIS operates in FIPS 140-3 compliant mode for SSH, TLS and SNMP protocols.

Backup and restore behavior for FIPS mode

This topic provides the details on how FIPS mode status is handled during NFVIS backup and restore operations.

If you back up NFVIS configurations when FIPS mode is enabled, then upon restore, FIPS mode is configured but needs a manual reboot to enable it. 


Backup configuration
nfvis#
nfvis# show running-config security
security fips
nfvis# show security
security fips-status ENABLED
nfvis#

After restore
nfvis#
nfvis# show running-config security
security fips
nfvis# show security fips-status
security fips-status CONFIGURED_REBOOT_TO_ENABLE
nfvis#

After reboot
nfvis#
nfvis# show running-config security
security fips
nfvis# show security
security fips-status ENABLED
nfvis#

When you backup NFVIS configurations with FIPS mode disabled, but the system where you restore the configurations has FIPS mode enabled, upon restore, the NFVIS configurations disable FIPS mode but the system has to reboot for FIPS mode to be in DISABLED state. 


Backup configurations
nfvis# show running-config security fips
% No entries found.
nfvis# show security fips-status
security fips-status DISABLED
nfvis# 

Restore system configurations
nfvis#
nfvis# show running-config security
security fips
nfvis# show security
security fips-status ENABLED
nfvis#

After restore
nfvis# show running-config security
% No entries found.
nfvis# show security             
security fips-status UNCONFIGURED_REBOOT_TO_DISABLE
nfvis# 

After reboot
nfvis# show running-config security fips
% No entries found.
nfvis# show security fips-status
security fips-status DISABLED
nfvis#

FIPS operational status

This topic provides reference information about the operational states available when you try to ENABLE FIPS mode and the possible operational state transitions for FIPS mode.

These are the operational states when you try to ENABLE FIPS mode:

  • DISABLED

  • CONFIGURED-REBOOT-TO-ENABLE

  • ENABLED

  • UNCONFIGURED-REBOOT-TO-DISABLE

  • FAILED

Table 1. FIPS mode operational state transitions

From

To

Description

DISABLED

CONFIGURED-REBOOT-TO-ENABLE

If the Oper data of FIPS-state leafs was previously set to DISABLED and if the security FIPS configuration is pushed

DISABLED

FAILED

If there is an error while pushing the security FIPS configuration

CONFIGURED-REBOOT-TO-ENABLE

ENABLED

If the FIPS-mode configuration is successful before and the Oper data was set to CONFIGURED-REBOOT-TO-ENABLE, then after REBOOT set the Oper data to ENABLED

CONFIGURED-REBOOT-TO-ENABLE

FAILED

If the Oper data of FIPS-state leafs was previously set to CONFIGURED-REBOOT-TO-ENABLE and there was an error while removing FIPS-mode configuration

CONFIGURED-REBOOT-TO-ENABLE

DISABLED

If the FIPS-mode is UNCONFIGURED while restoring from a backup package or factory-reset and the current FIPS-status is CONFIGURED-REBOOT-TO-ENABLE

ENABLED

DISABLED

After factory-reset (of any type)

ENABLED

FAILED

If there is an error while disabling the FIPS mode

ENABLED

UNCONFIGURED-REBOOT-TO-DISABLE

If the FIPS-mode is UNCONFIGURED while restoring from a backup package and the current FIPS-status is ENABLED

FAILED

CONFIGURED-REBOOT-TO-ENABLE

If the Oper date of FIPS-state leafs was previously set to FAILED and now configuring FIPS-mode

FAILED

DISABLED

If the Oper date of FIPS-state leafs was previously set to FAILED and now issued factory-reset

UNCONFIGURED-REBOOT-TO-DISABLE

DISABLED

If the Oper data of FIPS-state leafs was previously set to UNCONFIGURED-REBOOT-TO-DISABLE and then NFVIS is rebooted

UNCONFIGURED-REBOOT-TO-DISABLE

CONFIGURED-REBOOT-TO-ENABLE

If the Oper data of FIPS-state leafs was previously set to UNCONFIGURED-REBOOT-TO-DISABLE and FIPS-mode config is successful

UNCONFIGURED-REBOOT-TO-DISABLE

FAILED

If the Oper data of FIPS-state leafs was previously set to UNCONFIGURED-REBOOT-TO-DISABLE and if the FIPS-mode config was unsuccessful