Configuring the JUNOS-FIPS Router

To configure a Juniper Networks router running JUNOS-FIPS, the Crypto Officer performs the following tasks in the order listed:

• Establish a root password conforming to the JUNOS-FIPS password guidelines discussed in Passwords and Supported Cipher Sets .
• For strict FIPS compliance, delete all rollback configurations.
• For strict FIPS compliance, reset any existing user passwords to ensure encryption with FIPS algorithms.
• For strict FIPS compliance, reset all keys.
• Apply a tamper-evident seal to the PCMCIA slot on applicable router models.
• For FIPS Level 2 operation, apply a tamper-evident label to seal each Routing Engine into the chassis. On some models, tamper-evident labels must be applied to other components as well. See the FIPS Level 2 Label Installation Instructions for details. Tamper-evident labels are ordered separately and applied according to the instructions included in the label kit.
• Establish Crypto Officer and other JUNOS-FIPS User logins. For more information about Crypto Officer and JUNOS-FIPS User logins, see Crypto Officer and JUNOS-FIPS User Configurations .

  Note: The set of JUNOS-FIPS permissions that distinguish Crypto Officers from other JUNOS-FIPS Users are secret, security, maintenance, and control. All users should be assigned to a login class that contains all or none of these permissions.

• Every AS II FIPS PIC used for external IPSec must be authorized. AS II FIPS PICs can be used for services such as firewalls or Network Address Translation (NAT) without authorization, but all external IPSec tunnels require authorization. For more information about authorizing AS II FIPS PICs, see Authorizing the AS II FIPS PIC .
• Connect the router to the network and proceed with normal router configuration.

Copyright © 2009, Juniper Networks, Inc. All rights reserved. Trademark Notice.