Page History

Reconfiguring snmpv3 For Successful FIPs Mode

    admin@sbc1% show oam snmp trapTarget <trap_target_name>
      ipAddress <ip_address>
      port <port>
      trapType <v3>
      targetUsername <name>
      targetSecurityLevel <authPriv | authNoPriv>

      state enabled
      
            Example:
               admin@sbc1% set oam snmp trapTarget <trap_target_name> state disabled

               admin@sbc1% commit

      admin@sbc1% set oam snmp users <targetUserName> authKey <auth_key>
      admin@sbc1% set oam snmp users <targetUserName> privKey <priv_key>
      admin@sbc1% commit

Use the Fips-140-2 window to enable FIPS-140-2 mode.

The

The following changes have been made to achieve FIPS 140-2 certification:

• Self-Tests- The

  Spacevars
  0 product

  implements cryptographic algorithms using software firmware and hardware and the modules perform various self-tests (power-up self-test, conditional self-test, and critical function self-test) to verify their functionality and correctness. If any of the tests fail, the module goes into “Critical Error” state and it disables all access to cryptographic functions and Critical Security Parameters (CSPs). The management interfaces do not respond to any commands until the module is operational. The Crypto Officer must reboot the modules to clear the error and return to normal operational mode.

  Note
  Self-tests are performed only when the system is running in FIPS 140-2 mode.

  
  The various self-tests are as follows:

  • Power-Up self-tests- The

    Spacevars
    0 product

    performs self-tests at power-up to verify the integrity of the firmware images and the correct operation of the FIPS-approved algorithm implementation in the modules
  • Conditional self-tests- The

    Spacevars
    0 product

    implements conditional self-tests such as Continuous Random Number Generator Tests (CRNGT), RSA Pair-wise Consistency Tests, Firmware Load Tests, and so on.
  • Critical function tests- The

    Spacevars
    0 product

    implements the SP 800-90A CTR_DRBG as it's random number generator. The SP 800-90A specification requires that certain critical functions be tested conditionally to ensure the security of the DRBG. Therefore, the critical function tests are implemented by the cryptographic modules.

  FIPS Finite State Model- The following diagram demonstrates the 

  Spacevars
  0 product

  states and state transitions that occur within the

  Spacevars
  0 product

  :

• Install/upgrade Software Integrity Check- Software updates or patches that are to be loaded onto the machine are automatically checked for integrity by validating

  Spacevars
  0 company

   provided signature file for the particular package. (See install/upgrade guide). Failure in validation causes the installation/upgrade to be aborted.

• TLS v1.1 and v1.2 support for EMA/PM and SIP/TLS- TLS v1.1 and v1.2 provide resistance to certain known attacks (e.g. the BEAST attack affecting TLS v1.0) against earlier TLS versions and offer additional cipher suites not supported with TLS v1.0.

  Note
  Although TLS v1.0 and v1.2 are enabled by default, Spacevars 0 company  recommends disabling v1.0 (if possible) in favor of the more-secure TLS v1.2, if browser support (for EMA/PM) and SIP peer interoperability (for SIP/TLS) considerations permit.

  
  

• Configuration database encryption key regeneration support- The System Administrator can cause the encryption keys used to protect sensitive information in the configuration database to be regenerated.

• SSH key regeneration support- The System Administrator can regenerate the RSA keys used by the

  Spacevars
  0 product

  to authenticate itself for SFTP and for CLI and netconf over ssh at any time.

Enabling FIPS-140-2 mode

FIPS compliant operating mode is a mode of system operation that is fully compliant with FIPS-140-2 at security level 1+. Putting the system in FIPS-140-2 operating mode requires enabling the fips-140-2 mode parameter as well as configuring other parameters. 

To enable Fips-140-2 mode

1. On the SBC main screen, go to Administration > Users and Application Management > Fips-140-2. The Fips-140-2 window opens.

2. In Admin, select the name of the SBC system. The Edit Fips-140-2 options open.

   Caption
   0 Figure 1 Users and Application Management - Fips-140-2

   
   

3. Use the Mode option to enable Fips-140-2 mode.

Reconfiguration Steps After Enabling FIPS-140-2 Mode

1. Keys (authKey/privKey) for all snmp users must be reconfigured. This applies to all snmp users that are used for authPriv/authNoPriv security level trap targets.

admin@sbc1% set oam snmp users emstrapuser authKey Xd:aa:1f:09:75:6e:f6:da:NN:NN:NN:NN:NN:0d
admin@sbc1% set oam snmp users emstrapuser privKey Xd:aa:1f:09:75:6e:f6:da:NN:NN:NN:NN:NN:0d
admin@sbc1% commit

2.  Enable authPriv/authNoPriv trap targets:

admin@sbc1% set oam snmp trapTarget <trap_target_IP> state enabled