Understanding Junos OS in FIPS Mode
Federal Information Processing Standards (FIPS) 140-2 defines security levels for hardware and software that perform cryptographic functions. By meeting the applicable overall requirements within the FIPS standard, Juniper Networks EX Series Ethernet switches running the Juniper Networks Junos operating system (Junos OS) in FIPS mode comply with the FIPS 140-2 Level 1 standard.
Operating EX Series Ethernet switches in a FIPS 140-2 Level 1 environment requires enabling and configuring FIPS mode on the switches from the Junos OS CLI.
The Crypto Officer enables FIPS mode in Junos OS and sets up keys and passwords for the system and other FIPS users who can view the configuration. Both user types can also perform normal configuration tasks on the switch (such as modify interface types) as individual user configuration allows.
Be sure to verify the secure delivery of your switch and apply tamper-evident seals to its vulnerable ports.
About the Cryptographic Boundary on Your EX Series Switch
FIPS 140-2 compliance requires a defined cryptographic boundary around each cryptographic module on a switch. Junos OS in FIPS mode prevents the cryptographic module from executing any software that is not part of the FIPS-certified distribution, and allows only FIPS-approved cryptographic algorithms to be used. No critical security parameters (CSPs), such as passwords and keys, can cross the cryptographic boundary of the module by, for example, being displayed on a console or written to an external log file.
For the Juniper Networks EX Series switches that are certified at FIPS-140-2 Level 1, the cryptographic boundary of the module is determined by the chassis type. For a list of FIPS-certified switches and the cryptographic boundary of each switch, see Table 1.
Table 1: Cryptographic Boundaries on FIPS-Certified EX Series Switches
Virtual Chassis features are not supported in FIPS mode—they have not been tested by Juniper Networks. Do not configure a Virtual Chassis in FIPS mode.
To physically secure the cryptographic module, all EX Series switches require a tamper-evident seal on the USB and mini-USB ports.
How FIPS Mode Differs from Non-FIPS Mode
Unlike Junos OS in non-FIPS mode, Junos OS in FIPS mode is a nonmodifiable operational environment. In addition, Junos OS in FIPS mode differs in the following ways from Junos OS in non-FIPS mode:
Self-tests of all cryptographic algorithms are performed at startup.
Self-tests of random number and key generation are performed continuously.
Weak cryptographic algorithms such as Data Encryption Standard (DES) and Message Digest 5 (MD5) are disabled.
Weak or unencrypted management connections must not be configured.
Passwords must be encrypted with strong one-way algorithms that do not permit decryption.
Administrator passwords must be at least 10 characters long.
For specific configuration limitations and restrictions, see Understanding Configuration Limitations and Restrictions on Junos OS in FIPS Mode.
How Junos FIPS Mode Differs from Junos-FIPS
Junos FIPS mode is a software package that must be installed in order to enable FIPS mode on EX Series Ethernet switches. The Junos-FIPS image is a separately downloadable Junos OS image available for Juniper Networks SRX Series Services Gateways.
Junos FIPS mode is available only on the EX Series switches listed in Table 1 that are running Junos OS Release 15.1X53-D55.
Validated Version of Junos OS in FIPS Mode
To determine whether a Junos OS release is NIST-validated, see the compliance advisor page on the Juniper Networks Web site (https://apps.juniper.net/compliance/).
How to Use FIPS Documentation
For configuration and operational tasks that are specific to FIPS mode on EX Series switches, be sure to use the documentation for Junos OS in FIPS mode. Do not use the documentation for Junos-FIPS statements and commands because the syntax and options might not apply to FIPS mode.
For Junos OS configuration and operational tasks that are not specific to FIPS mode, see other EX Series hardware and software documentation under the switching category at https://www.juniper.net/documentation/product/en_US/junos-os.