Enable FIPS Mode

As Security Administrator, you must establish a root password conforming to the FIPS password requirements in Configure Password Rules for an Authorized Administrator. When you enable FIPS mode in Junos OS on the device, you cannot configure passwords unless they meet this standard.

Local passwords are encrypted with the secure hash algorithm SHA256 or SHA512. Password recovery is not possible in Junos OS in FIPS mode. Junos OS in FIPS mode cannot boot into single-user mode without the correct root password.

To enable FIPS mode in Junos OS on the device:

  1. Zeroize the device to delete all CSPs before entering FIPS mode. Refer to Overview of Zeroization to Clear System Data for FIPS Mode section for details.
  2. After the device comes up in ’Amnesiac mode’, login using username root and password "" (blank).
  3. Configure root authentication with password at least 10 characters or more.
  4. Load configuration onto device and commit new configuration.
  5. The fips-mode and jpfe-fips are optional packages needed for enabling FIPS. These packages are part of Junos OS software. To enable these packages, use below commands:
  6. Configure chassis boundary fips by setting set system fips chassis level 1 and commit.
  7. After deleting and reconfiguring CSPs, commit will go through and device needs reboot to enter FIPS mode.
  8. Reboot the device:
  9. After rebooting the device, FIPS self-tests will run and device enters FIPS mode.