FIPS Level 1 Support (Software FIPS)

understanding ivanti fips level 1 support what is fips? federal information processing standard (fips) are a set of standards that define security requirements for products that implement cryptographic modules used to secure sensitive but unclassified information the most recent standards are defined in the fips publication 140 3 the fips documents define, among other things, security levels for computer and networking equipment u s federal government departments, and other organizations, use fips to evaluate the cryptographic capabilities of the equipment they consider for purchase cryptographic modules are validated against separate areas of the fips specification an overall certification level is assigned based on the minimum level achieved in any area although primarily aimed at environments requiring strict security, fips levels are increasingly enforced as qualifying criteria for all u s federal government contracts security conscious private enterprises might also use fips levels as an equipment evaluation benchmark fips levels also serve as a customer neutral description of vendor requirements vendors can engineer security products to fips levels and extend the applicability and eligibility of these products across a broad customer base, thereby eliminating exhaustive and time consuming customer by customer product qualification procedures what is fips level 1 support? ivanti offers fips level 1 support for both ivanti connect secure and policy secure both services use a 140 3 level 1 certified cryptographic module to comply with fips when fips level 1 support is enabled applications, such as browsers, accessing the web server must support transport layer security (tls), the latest version of secure socket layer (ssl) if the platform features hardware acceleration, then for ssl processing ssl hardware acceleration is disabled as hardware acceleration does not comply with fips validation only fips approved algorithms are used when in fips level 1 support is enabled for more information about the cryptography module, see the validation certificate https //csrc nist gov/projects/cryptographic module validation program/certificate/4779 to see historical and revoked module lists, validated cryptographic modules https //csrc nist gov/projects/cryptographic module validation program/validated modules/search#2012 enabling fips level 1 support once you enable fips level 1 support, your browser is restricted to specific custom cipher strengths a list of supported ciphers is shown during the enabling process when you enable fips level 1 support, the following events occur on the system the web server restarts and turns on fips level 1 support the web server now allows only tlsv1 3 and tlsv1 2 protocols that include fips approved cryptographic algorithms which include suite b cipher suites once fips level 1 support is enabled, new client sessions will use fips if the client supports fips existing client sessions may not be using fips to ensure fips capable clients are in fips level 1 support, all client sessions should be terminated after the fips level 1 support is enabled administrators can use the system > status > active users page to terminate client sessions the following event logs are generated for fips level 1 support sys30966 when the web server turns fips level 1 support on adm30965 when the administrator turns fips level 1 support on or off err30967 when the web server fails to turn on fips level 1 support to enable fips level 1 support select system > configuration > security > inbound ssl options under ssl fips mode option, select turn on fips mode see enabling fips level 1 support docid\ ounelj2obg3ver zsa4dg enabling fips level 1 support once you turn on fips level 1 support, the following changes are made under allowed ssl and tls version, the accept only tls 1 2 and later option is selected under allowed encryption strength, the maximum compatibility ciphers is set see enabling fips level 1 support docid\ ounelj2obg3ver zsa4dg only fips approved algorithms are selected all other options under this section are disabled see supported cipher suites when fips level 1 support is enabled docid\ ounelj2obg3ver zsa4dg under encryption strength, the do not allow connections from browsers that only accept weaker ciphers option is selected you cannot disable this selection click save changes entries are made in the events logs (see events log entries for fips level 1 docid\ ounelj2obg3ver zsa4dg ) and admin access logs (see admin access logs for fips level 1 encryption strength changes docid\ ounelj2obg3ver zsa4dg ) to show that fips level 1 support is enabled events log entries for fips level 1 admin access logs for fips level 1 encryption strength changes turning off fips level 1 support from the serial console problem description if you have fips level 1 support enabled and your browser does not support the required cipher suites, you cannot access the device if this happens to an administrator account, you can no longer administer or configure the system solution you can turn off fips level 1 support and reset the encryption strength from the device's serial console after choosing that option, ssl options are reset to accept only tls 1 2 and later and to maximum compatibility (medium ciphers) open a serial console to your device and select option 8 turn off fips mode and reset allowed encryption strength for ssl turning off fips level 1 and resetting encryption strength from the serial console please choose the operation to perform network settings and tools create admin username and password display log/status system operations toggle password protection for the console (off) create a super admin session system maintenance turn off fips mode and reset allowed encryption strength for ssl choice 8 once you turn off fips level 1 support, option 8 is relabeled "reset allowed encryption strength for ssl " installing a self signed certificate from the serial console problem description an administrator can be locked out of the system if their browser does not support the certificate assigned to the network port for example, if your system has an ecc certificate assigned to the internal port and your browser does not support ecc certificates you cannot log in to the device using the internal port solution you can use the serial console to create and install a self signed rsa certificate onto the internal port to allow access once you connect to the serial console, select option 4 system operations followed by option 7 install self signed certificate it may take a few minutes for the 2048 bit key size self signed certificate to be created and installed on your device once the certificate is installed, you can now log in to the device creating and installing an rsa certificate from the serial console please choose the operation to perform network settings and tools create admin username and password display log/status system operations toggle password protection for the console (off) create a super admin session system maintenance turn off fips mode and reset allowed encryption strength for ssl choice 4 please choose the operation to perform reboot this ivanti connect secure shutdown this ivanti connect secure restart services at this ivanti connect secure rollback this ivanti connect secure factory reset this ivanti connect secure clear all configuration data at this ivanti connect secure install self signed certificate choice 7 are you sure you want to install a newly created rsa self signed certificate on the internal port? (y/n) y please provide information to create a self signed web server digital certificate common name (example secure company com) myname mycompany com organization name (example company inc ) mycompany inc please enter some random characters to augment the system's random key generator we recommend that you enter approximately thirty characters random text (hit enter when done)\ abcdef1234567 creating self signed digital certificate this may take several minutes the self signed digital certificate was successfully created supported cipher suites when fips level 1 support is enabled the tables in this topic list the cipher suites that are supported by the web server when the fips level 1 support is enabled when fips level 1 support is enabled, only v1 3 v1 2 and aes256, 3des and aes128 are allowed the order of the cipher suites is not dependent on the ssl hardware acceleration module since hardware acceleration is not used when fips level 1 support is enabled when fips level 1 support is enabled, the following settings are automatically configured in the ssl options window under allowed ssl and tls version, the accept only tls 1 2 and later option is selected under allowed encryption strength, the maximum compatibility ciphers option is selected only fips approved algorithms are selected all other options under this section are disabled under encryption strength option, the do not allow connections from browsers that only accept weaker ciphers option is selected ssl hardware acceleration is disabled ipsec hardware acceleration is not affected by the fips level 1 support being enabled in the following table, the first four cipher suites are given preference due to the requirements in rfc 6460 the first two cipher suites meeting the requirement for suite b profile for tls 1 2 the next two meeting the requirement for suite b transitional profile for tls 1 3 and 1 2 the following table lists the supported cipher suites with fips level 1 support on and ecc server certificates in use cipher suite protocol tls ecdhe ecdsa with aes 256 gcm sha384 tls ecdhe rsa with aes 256 gcm sha384 tls ecdhe ecdsa chacha20 poly1305 tls ecdhe rsa chacha20 poly1305 tls ecdhe ecdsa with aes 128 gcm sha256 tls ecdhe rsa with aes 128 gcm sha256 tls rsa with aes 256 gcm sha384 tls rsa with aes 128 gcm sha256 tlsv1 2 and later tls aes 256 gcm sha384 tls chacha20 poly1305 sha256 tls aes 128 gcm sha256 tlsv1 3 the following table lists the supported cipher suites with fips level 1 support on and rsa server certificates in use cipher suite protocol tls ecdhe rsa with aes 256 gcm sha384 tls ecdhe rsa chacha20 poly1305 tls ecdhe rsa with aes 128 gcm sha256 tls rsa with aes 256 gcm sha384 tls rsa with aes 128 gcm sha256 tlsv1 2 and later