You must reconfigure SNMPv3 before enabling FIPs mode. Failure to do so could cause the SBC to crash due to excessive trap generation. Perform the following steps to reconfigure snmpv3. The SBC releases 7.2.x and 10.1.3 are compliant with FIPS-140-2 and FIPS-140-3, respectively. To verify the current status of FIPS certification, contact the Global Support Assistance Center: Ribbon Support Portal: https://ribboncommunications.com/services/ribbon-support-portal Voice: +1-833-RIBBON1 (1-833-742-2661) You must disable all trap targets with authPriv/authNoPriv securityLevel. Example: The SBC Core supports FIPS-140-3 level 1 certification for its cryptographic modules. It implements FIPS-140-3 Level 1 validated cryptographic hardware modules and software tool kits and operates this module in FIPS-140-3 approved mode for all cryptographic operations. The following activities were made to achieve FIPS-140-3 certification: Self-Tests – The SBC implements cryptographic algorithms using software firmware and hardware and the modules perform various self-tests (power-up self-test, conditional self-test, and critical function self-test) to verify their functionality and correctness. If any of the tests fail, the module goes into “Critical Error” state and it disables all access to cryptographic functions and Critical Security Parameters (CSPs). The management interfaces do not respond to any commands until the module is operational. The Crypto Officer must reboot the modules to clear the error and return to normal operational mode. Self-tests are performed only when the system is running in FIPS-140-3 mode. FIPS Finite State Model- The ability to change the FIPS-140-3 mode is reserved only for users having Administrator permissions; the Administrator is a role in the SBC that may be assigned to a Crypto Officer in a FIPS-compliant system. TLS v1.1 and v1.2 support for EMA/PM and SIP/TLS- TLS v1.1 and v1.2 provide resistance to certain known attacks (e.g. the BEAST attack affecting TLS v1.0) against earlier TLS versions and offer additional cipher suites not supported with TLS v1.0. Although TLS v1.0 and v1.2 are enabled by default, Ribbon recommends disabling v1.0 (if possible) in favor of the more-secure TLS v1.2, if browser support (for EMA/PM) and SIP peer interoperability (for SIP/TLS) considerations permit. As per FIPS-140-3 standards, Critical Security Parameters (CSPs) are not transferrable from non-FIPS to FIPS mode. So, after enabling FIPS mode, the Operator must install new TLS certificates to set the EMA/PM as operational. Ribbon recommends to back up the current encrypted parameters in plain text, if possible, as well as perform a full configuration backup immediately after this action successfully completes. In Admin, select the name of the SBC system. The FIPS-140-3 mode. Once you enable FIPS-140-3 mode, you cannot disable it through the configuration. A fresh software install (that discards all prior states) is required to set the FIPS-140-3 mode to 'disabled'. The options are: After enabling FIPS-140-3, you must reconfigure the keys (authKey/privKey) for all SNMP users (this applies to all SNMP users for authPriv/authNoPriv security level trap targets). Use the following CLI commands to reconfigure the keys: Enable the authPriv/authNoPriv trap targets: The ability to change the FIPS-140-3 mode is reserved only for users having Administrator permissions; the Administrator is a role in the SBC that may be assigned to a Crypto Officer in a FIPS-compliant system.Reconfiguration Step Before Enabling FIPS-140-3 Mode
admin@sbc1% show oam snmp trapTarget EMS_-10.54.71.176
ipAddress 10.54.71.176;
port 162;
trapType v3;
targetUsername emstrapuser;
targetSecurityLevel authPriv;
state enabled;
admin@sbc1% set oam snmp trapTarget EMS_-10.54.71.176 state disabled
admin@sbc1% commit
Enable FIPS-140-3 mode
The various self-tests are as follows:
The FIPS compliant operating mode is a mode of system operation that is fully compliant with FIPS-140-3 at security level 1+. Putting the system in FIPS-140-3 operating mode requires enabling the FIPS-140-3 mode
parameter as well as configuring other parameters. To enable FIPS-140-3 mode
The FIPS-140-3 window opens.
The Edit FIPS-140-3 options open.Parameter Description Mode Reconfiguration Steps After Enabling FIPS-140-3 Mode
admin@sbc1% set oam snmp users emstrapuser authKey Xd:aa:1f:09:75:6e:f6:da:NN:NN:NN:NN:NN:0d
admin@sbc1% set oam snmp users emstrapuser privKey Xd:aa:1f:09:75:6e:f6:da:NN:NN:NN:NN:NN:0d
admin@sbc1% commit
admin@sbc1% set oam snmp trapTarget <trap_target_IP> state enabled