Description

Federal Information Processing Standards (FIPS) 140-2 defines security levels for hardware and software that perform cryptographic functions. Operating MX Series routers in a FIPS 140-2 Level 1 environment requires enabling and configuring FIPS mode from the Junos OS command-line interface (CLI).

Symptoms

Junos OS in FIPS mode prevents the cryptographic module from executing any software that is not part of the FIPS-certified distribution and allows only FIPS-approved cryptographic algorithms to be used.

Solution

  • To prepare your device for operation as a FIPS cryptographic module, perform zeroize before enabling FIPS mode.
  • To begin re-purposing your device for non-FIPS operation, perform zeroize before disabling FIPS mode on the device.

Validated Version of Junos OS in FIPS Mode:

To determine whether a Junos OS release is NIST-validated, visit the Juniper Compliance web page .

  1. Zeroize the device before entering FIPS mode

  2. After the device comes up in 'Amnesiac mode', login using username root and password "" (blank).

  3. Configure root authentication.

  4. Install fips-mode and jpfe-fips packages by executing the following commands: (No need to download any specific package for this) 

    host# run request system software add optional://fips-mode      
      Verified fips-mode signed by PackageProductionEc_2019 method ECDSA256+SHA256

host# run request system software add optional://jpfe-fips
      Verified jpfe-fips signed by PackageProductionEc_2019 method ECDSA256+SHA256

  5. Configure FIPS chassis level 

    host# set system fips chassis level 1
host# commit   <-- Device may return warning messages to delete older CSPs here
[edit]
   'system'
     reboot is required to transition to FIPS level 1
commit complete

[edit]
user@host# run request system reboot
Reboot the system ? [yes,no] (no) yes

  6. After rebooting the device, FIPS self-tests will run and device enters FIPS mode. 

    root@host:fips> show version | match FIPS
JUNOS Packet Forwarding Engine FIPS Support [xx.xx.xx]
JUNOS FIPS mode utilities [xxxxxx.xxxxx.xxxxxx]

Related Information