HP StorageWorks 1606 Brocade Fabric OS Administrator's Guide v6.3.0 (53-100133 - Page 571

Preparing the switch for FIPS D 1. Connect to the switch and log in as admin. 2. Enter the secCertUtil delete -ldapcacert command, where the is the name of the LDAP certificate on the switch. Example of deleting an LDAP CA certificate switch:admin> seccertutil delete -ldapcacert LDAPTestCa.pem WARNING!!! About to delete certificate: LDAPTestCa.cer ARE YOU SURE (yes, y, no, n): [no] y Deleted LDAP certificate successfully Preparing the switch for FIPS The following functions are blocked in FIPS mode. Therefore, it is important to prepare the switch by disabling these functions prior to enabling FIPS: • The root account and all root-only functions are not available. • HTTP, Telnet, RPC, SNMP protocols need to be disabled. Once these are blocked, you cannot use these protocols to read or write data from and to the switch. • The configDownload and firmwareDownload commands using an FTP server are blocked. See Table 98 on page 525 for a complete list of restrictions between FIPS and non-FIPS modes. ATTENTION Only roles with SecurityAdmin and Admin can enable FIPS mode. Overview of steps 1. Optional: Configure RADIUS server or LDAP server. 2. Optional: Configure authentication protocols. 3. For LDAP only: Install SSL certificate on Microsoft Active Directory server and CA certificate on the switch for using LDAP authentication. 4. Block Telnet, HTTP, and RPC. 5. Disable BootProm access. 6. Configure the switch for signed firmware. 7. Disable root access. 8. Enable FIPS. Enabling FIPS mode 1. Log in to the switch using an account assigned the admin or securityAdmin role. 2. Optional: Select the appropriate method based on your needs: • If the switch is set for RADIUS, modify each server to use only peap-mschapv2 as the authentication protocol using the aaaConfig --change or aaaConfig --remove command. Fabric OS Administrator's Guide 529 53-1001336-01