As Security Administrator, you must establish a root password conforming to the FIPS
password requirements in Overview of Password Specifications and Guidelines for Junos OS in FIPS Mode. When you enable
FIPS mode in Junos OS on the device, you cannot configure passwords unless they meet
this standard.
Local passwords are encrypted with the secure hash algorithm SHA256 or SHA512. Password
recovery is not possible in Junos OS in FIPS mode. Junos OS in FIPS mode cannot boot
into single-user mode without the correct root password.
To enable FIPS mode in Junos OS on the device:
-
Zeroize the device to delete all CSPs before entering FIPS mode. Refer to Overview of Zeroization to Clear System Data for FIPS Mode section
for details.
-
After the device comes up in ’Amnesiac mode’, login using username
root and password "" (blank).
FreeBSD/amd64 (Amnesiac) (ttyu0)
login: root
--- JUNOS 23.4R1.9 Kernel 64-bit JNPR-12.1-20231122.ee0e992_buil
root@host:~ # cli
root>
-
Configure root authentication with password at least 10 characters or
more.
root@host> edit
Entering configuration mode
[edit]
root@host# set system root-authentication plain-text-password
New password:
Retype new password:
[edit]
root@host# commit
commit complete
-
Load configuration onto device and commit new configuration. Configure Security
Administrator and login with Security Administrator credentials.
-
The
fips-mode and jpfe-fips are optional
packages needed for enabling FIPS. These packages are part of Junos OS software.
To enable these packages, use below commands:
root@host> request system software add optional://fips-mode
Verified fips-mode signed by PackageProductionECP256_2022 method ECDSA256+SHA256
-
Configure chassis boundary fips by setting
set system fips chassis
level 1 and commit.
[edit]
root@hostname# set system fips chassis level 1
-
After deleting and reconfiguring CSPs, commit will go through and device needs
reboot to enter FIPS mode.
[edit]
security-administrator@host# commit
[edit]
system reboot is required to transition to FIPS level 1
commit complete
-
Reboot the device:
[edit]
security-administrator@host# run request vmhost reboot
-
After rebooting the device, FIPS self-tests will run and device enters FIPS
mode.
security-administrator@host:fips>
