Example: Configuring FIPS Self-Tests
This example shows how to configure FIPS self-tests to run periodically.
Hardware and Software Requirements
You must have administrative privileges to configure FIPS self-tests.
The device must be running the evaluated version of Junos OS in FIPS mode software.
Overview
The FIPS self-test consists of the following suites of known answer tests (KATs):
kernel_kats—KAT for kernel cryptographic routinesmd_kats—KAT for libmd and libcopenssl_kats—KAT for OpenSSL cryptographic implementationssh_ipsec_kats—KAT for SSH IPsec Toolkit cryptographic implementation
In this example, the FIPS self-test is executed at 9:00 AM in New York City, USA, every Wednesday.
Instead of weekly tests, you can configure monthly tests
by including the month and day-of-month statements.
When a KAT self-test fails, a log message is written to the system log messages file with details of the test failure. Then the system panics and reboots.
Configuration
CLI Quick Configuration
To quickly configure this example, copy the
following commands into a text file, remove any line breaks, and then
paste the commands into the CLI at the [edit] hierarchy
level.
set system fips self-test periodic start-time 09:00 set system fips self-test periodic day-of-week 3
Procedure
Step-by-Step Procedure
To configure the FIPS self-test:
Configure the FIPS self-test to execute at 9:00 AM every Wednesday.
[edit system fips self-test] user@host# set periodic start-time 09:00 user@host# set periodic day-of-week 3
If you are done configuring the device, commit the configuration.
[edit system fips self-test] user@host# commit
Results
From configuration mode, confirm your configuration
by issuing the show system command. If the output does
not display the intended configuration, repeat the instructions in
this example to correct the configuration.
user@host# show system
fips {
self-test {
periodic {
start-time "09:00";
day-of-week 3;
}
}
}