Enabling FIPS Mode

FIPS mode is not automatically enabled when you install Junos OS on the device.

As Security Administrator, you must explicitly enable FIPS mode on the device by setting the FIPS level to 1 (one), the FIPS 140-3 level at which the devices are certified. A device on which FIPS mode is not enabled has a FIPS level of 0 (zero).

Note:

To transition to FIPS mode, passwords must be encrypted with a FIPS-compliant hash algorithm. The encryption format must be SHA-256 or higher. Passwords that do not meet this requirement, such as passwords that are hashed with MD5, must be reconfigured or removed from the configuration before FIPS mode can be enabled.

To enable FIPS mode in Junos OS on the device:

  1. Enter configuration mode:
  2. Enable FIPS mode on the device by setting the FIPS level to 1, and verify the level:
  3. After zeroize, the factory-default configuration enables the DHCP client and netconf-ssh. Disable the DHCP client and configure a firewall filter to restrict access to the netconf-ssh service.
    To disable DHCP service:
    To configure firewall filter for netconf-ssh service:
  4. Commit the configuration:
    Note:

    If the device terminal displays error messages about the presence of critical security parameters (CSPs), delete those CSPs, and then commit the configuration.

  5. Reboot the device:

    During the reboot, the device runs Known Answer Tests (KATS). It returns a login prompt:

    Note:

    The new hash algorithm affect only those passwords that are generated after commit.

    Log in to the device. The CLI displays a banner that is followed by a prompt that includes “:fips”:

  6. Reboot the device again to restore the HMAC-DRBG as an active random adapter:

    During the reboot, the device runs Known Answer Tests (KATS) as shown in the step 4. It returns a login prompt:

  7. After the reboot has completed, log in and use the show version local command to verify.
Note:

Use “local” keyword for operational commands in FIPS mode. For example, show version local, and show system uptime local.