FIPS mode is not automatically enabled when you install
Junos OS on the switch.
As Crypto Officer, you must explicitly enable FIPS mode on the switch by setting the FIPS level
to 1 (one), the FIPS 140-3 level at which your devices are certified. A switch on which FIPS
mode is not enabled has a FIPS level of 0 (zero).
Note: To transition to FIPS mode, passwords must be encrypted with a FIPS-compliant hash algorithm. The
encryption format must be SHA-256 or higher. Passwords that do not meet this requirement,
such as passwords that are hashed with MD5, must be reconfigured or removed from the
configuration before FIPS mode can be enabled.
To enable FIPS mode in Junos OS on the switch:
- Zeroize the switch to delete all CSPs before entering
FIPS mode.
-
After the device comes up in Amnesiac mode, login using console with username
root and password (blank).
- Configure root authentication with password at least 10
characters or more.
root@switch> edit
Entering configuration mode
[edit]root@switch# set system root-authentication plain-text-password
New password:
Retype new password:
root@switch# commit
configuration check succeeds commit complete
- Load configurationon to switch and commit new configuration.
- Configure Crypto Officer and login with Crypto Officer
credentials.
-
The
fips-mode.tgz is an optional package needed for enabling FIPS.
This package is part of Junos OS software. To enable this package, use below
command:
root@host>request system software add optional://fips-mode.tgz
Verified fips-mode signed by PackageProductionECP256_2022 method ECDSA256+SHA256
-
Configure system boundary fips by setting the
set system fips level 1
command followed by the commit command.
[edit]
root@hostname# set system fips level 1
Note:
The device might display warnings to delete older CSPs in loaded configuration-
Encrypted-password must be re-configured to use FIPS compliant hash.
- After deleting and reconfiguring the CSPs, commit is successful
and the switch needs reboot to enter FIPS mode.
crypto-officer@switch# commit
configuration check succeeds
[edit]
'system'
warning: reboot is required to transition to FIPS level 1
commit complete
[edit]
crypto-officer@switch# run request system reboot
- After rebooting the switch, FIPS self-tests will run and
switch enters FIPS mode.
crypto-officer@switch:fips>
Note: Use local keyword for operational
commands in FIPS mode. For example, show version local,
and show system uptime local.
