Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Example: Configuring FIPS Self-Tests

This example shows how to configure FIPS self-tests to run periodically.

Hardware and Software Requirements

  • The administrator must have administrative privileges to configure FIPS self-tests.

  • The device must be running the evaluated version of Junos OS in FIPS mode software.

Overview

The FIPS self-test consists of the following suites of known answer tests (KATs):

  • kernel_kats—KAT for kernel cryptographic routines

  • macsec_kats—KAT for MACsec cryptographic implementation

  • md_kats—KAT for libmd and libc

  • openssl-102_kats—KAT for OpenSSL v1.0.2 cryptographic implementation

  • openssl_kats—KAT for OpenSSL cryptographic implementation

  • quicksec-7_0_kats—KAT for QuickSec 7.0 Toolkit cryptographic implementation

  • quicksec_kats—KAT for QuickSec Toolkit cryptographic implementation

  • ssh_ipsec_kats—KAT for SSH IPsec Toolkit cryptographic implementation

In this example, the FIPS self-test is executed at 9:00 AM in New York City, USA, every Wednesday.

Note:

Instead of weekly tests, the administrator can configure monthly tests by including the month and day-of-month statements.

When a KAT self-test fails, a log message is written to the system log messages file with details of the test failure. Then the system panics and reboots.

Configuration

CLI Quick Configuration

To quickly configure this example, copy the following commands into a text file, remove any line breaks, and then paste the commands into the CLI at the [edit] hierarchy level.

Procedure

Step-by-Step Procedure

To configure the FIPS self-test:

  1. Configure the FIPS self-test to execute at 9:00 AM every Wednesday.

  2. If the administrator is done configuring the device, commit the configuration.

Results

From configuration mode, confirm the configuration by issuing the show system command. If the output does not display the intended configuration, repeat the instructions in this example to correct the configuration.