How To Enable The FIPS Mode Checklist

09/22/2021 58 People found this article helpful 472,121 Views

Description

A Federal Information Processing Standard (FIPS) is a publicly announced standardization developed by the United States federal government for use in computer systems by all non-military government agencies and by government contractors when properly invoked and tailored on a contract.

When operating in FIPS (Federal Information Processing Standard) Mode, the SonicWall security appliance supports FIPS 140-2 Compliant security. Among the FIPS-compliant features of the SonicWall security appliance include PRNG (Pseudo Random Number Generator) based on SHA-1 and only FIPS-approved algorithms are supported (DES, 3DES, and AES with SHA-1).

SonicWall UTM appliances are not configured to operate in FIPS-mode by default. This article describes the steps that must be taken to enable FIPS-mode operation.

Resolution

Resolution for SonicOS 7.X

This release includes significant user interface changes and many new features that are different from the SonicOS 6.5 and earlier firmware. The below resolution is for customers using SonicOS 7.X firmware.

To enable SonicWALL security appliance to comply with FIPS, complete the following steps:

Navigate to DEVICE | Firmware and Settings > Settings page
Select Enable FIPS mode option
The FIPS Mode Verification window appears with a FIPS-mode setting compliance checklist. The checklist displays every setting in your current SonicOS configuration that violates FIPS compliance so you can change these settings. You will need to navigate around the SonicOS management interface to make the changes. The checklist for an appliance with factory default settings is shown in this procedure.
If your SonicWALL appliance:
1. Complies with the checklist, go to step 9
2. Does not comply with the checklist, manually change or disable settings to be compliant with FIPS mode setting compliant checklist
Complete the checklist for FIPS compliance by navigating around the SonicOS management interface.
NOTE: The second Group VPN policy has HTTPS and SSH management enabled by default; uncheck these(along with other items) to enable FIPS mode)
Enable the Send LDAP Start TLS request and Require valid certificate from server options and select Local certificate for TLS to allow FIPS
Remove SSH Administration for FIPS on all interfaces.
Click OK or Cancel
The system requires a reboot to enable the newly enabled FIPS mode.