How to Enable and Configure Junos OS in FIPS Mode of Operation
You, as Cryptographic Officer, can enable and configure Junos OS in FIPS mode of operation on your device. Before you begin enabling and configuring FIPS mode of operation on the device:
Verify the secure delivery of your device. See Identifying Secure Delivery.
Apply tamper-evident seals. See Applying Tamper-Evident Seals to the Cryptographic Module.
To enable the Junos OS in FIPS mode of operation, perform the following steps:
- Zeroize the device before enabling FIPS mode of operation
user@host> request system zerioze
- Enable the FIPS mode on the device.
user@host# set system fips level 2
- Remove the CSPs on commit check and reboot the device.
user@host# commit
- Run integrity and self-tests on powering on the device when the module is operating in FIPS mode.
- Configure IKEv2 when AES-GCM is used for encryption of
IKE and/or IPSec.user@host# set security ike proposal <ike_proposal_name> encryption-algorithm ?Possible completions:3des-cbc 3DES-CBC encryption algorithmaes-128-cbc AES-CBC 128-bit encryption algorithmaes-128-gcm AES-GCM 128-bit encryption algorithmaes-192-cbc AES-CBC 192-bit encryption algorithmaes-256-cbc AES-CBC 256-bit encryption algorithmaes-256-gcm AES-GCM 256-bit encryption algorithmuser@host# set security ike proposal <ike_proposal_name> encryption-algorithm aes-256-gcmuser@host# set security ipsec proposal <ipsec_proposal_name> encryption-algorithm ?Possible completions:3des-cbc 3DES-CBC encryption algorithmaes-128-cbc AES-CBC 128-bit encryption algorithmaes-128-gcm AES-GCM 128-bit encryption algorithmaes-192-cbc AES-CBC 192-bit encryption algorithmaes-192-gcm AES-GCM 192-bit encryption algorithmaes-256-cbc AES-CBC 256-bit encryption algorithmaes-256-gcm AES-GCM 256-bit encryption algorithmuser@host# set security ipsec proposal <ipsec_proposal_name> encryption-algorithm aes-128-gcmuser@host# set security ike gateway <gateway_name> version ?Possible completions:v1-only The connection must be initiated using IKE version 1v2-only The connection must be initiated using IKE version 2user@host# set security ike gateway <gateway_name> version v2-onlyuser@host# commitcommit complete
- Ensure that the backup image of the firmware is also a JUNOS-FIPS image by issuing the request system snapshot command.
The show configuration security ike and show configuration security ipsec commands display the approved and configured IKE/IPsec configuration for the device operating in FIPS-approved mode.
user@host-srx1500:fips> show version Hostname: host-srx1500 Model: srx1500 Junos: 17.4R1-S1.9 JUNOS OS Kernel 64-bit [20180127.fdc8dfc_builder_stable_11] JUNOS OS libs [20180127.fdc8dfc_builder_stable_11] JUNOS OS runtime [20180127.fdc8dfc_builder_stable_11] JUNOS OS time zone information [20180127.fdc8dfc_builder_stable_11] JUNOS OS libs compat32 [20180127.fdc8dfc_builder_stable_11] JUNOS OS 32-bit compatibility [20180127.fdc8dfc_builder_stable_11] JUNOS py extensions [20180131.022854_builder_junos_174_r1_s1] JUNOS py base [20180131.022854_builder_junos_174_r1_s1] JUNOS OS vmguest [20180127.fdc8dfc_builder_stable_11] JUNOS OS crypto [20180127.fdc8dfc_builder_stable_11] JUNOS network stack and utilities [20180131.022854_builder_junos_174_r1_s1] JUNOS libs [20180131.022854_builder_junos_174_r1_s1] JUNOS libs compat32 [20180131.022854_builder_junos_174_r1_s1] JUNOS runtime [20180131.022854_builder_junos_174_r1_s1] JUNOS Web Management Platform Package [20180131.022854_builder_junos_174_r1_s1] JUNOS srx libs compat32 [20180131.022854_builder_junos_174_r1_s1] JUNOS srx runtime [20180131.022854_builder_junos_174_r1_s1] JUNOS srx platform support [20180131.022854_builder_junos_174_r1_s1] JUNOS common platform support [20180131.022854_builder_junos_174_r1_s1] JUNOS srxtvp runtime [20180131.022854_builder_junos_174_r1_s1] JUNOS pppoe [20180131.022854_builder_junos_174_r1_s1] JUNOS mtx network modules [20180131.022854_builder_junos_174_r1_s1] JUNOS modules [20180131.022854_builder_junos_174_r1_s1] JUNOS srxtvp modules [20180131.022854_builder_junos_174_r1_s1] JUNOS srxtvp libs [20180131.022854_builder_junos_174_r1_s1] JUNOS srx libs [20180131.022854_builder_junos_174_r1_s1] JUNOS srx Data Plane Crypto Support [20180131.022854_builder_junos_174_r1_s1] JUNOS daemons [20180131.022854_builder_junos_174_r1_s1] JUNOS srx daemons [20180131.022854_builder_junos_174_r1_s1] JUNOS Online Documentation [20180131.022854_builder_junos_174_r1_s1] JUNOS jail runtime [20180127.fdc8dfc_builder_stable_11] JUNOS FIPS mode utilities [20180131.022854_builder_junos_174_r1_s1]
The fips keyword next to the hostname in the output indicates that the module is operating in FIPS mode for Junos Software Release 17.4R1-S1.
user@host-srx1500:fips> show configuration security ike
proposal ike-proposal1 {
authentication-method pre-shared-keys;
dh-group group14;
encryption-algorithm aes-256-gcm;
}
policy ike-policy1 {
mode main;
proposals ike-proposal1;
pre-shared-key ascii-text "$9$Hq.5zF/tpBUj9Au0IRdbwsaZ"; ## SECRET-DATA
}
gateway gw1 {
ike-policy ike-policy1;
address 198.51.100.0;
local-identity inet 203.0.113.0;
external-interface ge-0/0/3;
version v2-only;
}user@host-srx1500:fips> show configuration security ipsec
proposal ipsec-proposal1 {
protocol esp;
encryption-algorithm aes-128-gcm;
}
policy ipsec-policy1 {
perfect-forward-secrecy {
keys group14;
}
proposals ipsec-proposal1;
}
vpn vpn1 {
bind-interface st0.0;
ike {
gateway gw1;
ipsec-policy ipsec-policy1;
}
}