HP Cisco MDS 9134 Cisco MDS 9000 Family Fabric Manager Configuration Guide, Re - Page 730

Configuration Guidelines Chapter 38 Configuring FIPS Send documentation comments to [email protected] Configuration Guidelines Follow these guidelines before enabling FIPS mode. • Make your passwords a minimum of eight characters in length. • Disable Telnet. Users should log in using SSH only. • Disable remote authentication through RADIUS/TACACS+. Only users local to the switch can be authenticated. • Disable SNMP v1 and v2. Any existing user accounts on the switch that have been configured for SNMPv3 should be configured only with SHA for authentication and AES/3DES for privacy. • Disable VRRP. • Delete all IKE policies that either have MD5 for authentication or DES for encryption. Modify the policies so they use SHA for authentication and 3DES/AES for encryption. • Delete all SSH Server RSA1 key-pairs. Enabling FIPS Mode To enable FIPS mode using Fabric Manager, follow these steps: Step 1 Expand Switches from the Physical Attributes pane. Expand Security and then select FIPS. You see the FIPS activation details in the Information pane as shown in Figure 38-1. Figure 38-1 FIPS Activation in Fabric Manager Step 2 Step 3 Step 4 Check the ModeActivation check box next to the switch for which you want to enable FIPS mode. Click Apply Changes to commit and distribute these changes. Click Undo Changes to discard any unsaved changes. To enable FIPS mode using Device Manager, follow these steps: Step 1 Choose Physical > System or right-click and select Configure. You see the System dialog box as shown in Figure 38-2. 38-2 Cisco MDS 9000 Family CLI Configuration Guide OL-16184-01, Cisco MDS SAN-OS Release 3.x