Citrix SD-WAN

FIPS Compliance

In Citrix SD-WAN, FIPS mode enforces users to configure FIPS compliant settings for their IPsec Tunnels and IPsec settings for Virtual Paths.

  • Displays the FIPS compliant IKE Mode.
  • Displays a FIPS Compliant IKE DH Group from which users can select the required parameters for configuring the appliance in FIPS compliant mode (2,5,14 – 21).
  • Displays the FIPS compliant IPsec Tunnel Type in IPsec settings for Virtual Paths

  • IKE Hash and (IKEv2) Integrity mode, IPsec auth mode.

  • Performs audit errors for FIPS based Lifetime Settings

To enable FIPS compliance by using the Citrix SD-WAN GUI:

  1. Go to Configuration > Virtual WAN > Configuration Editor > Global, and select Enable FIPS Mode.

Enabling FIPS mode enforces checks during configuration to ensure that all IPsec related configuration parameters adhere to the FIPS standards. You are prompted through audit-errors and warnings to configure IPsec.

To configure Virtual Path IPsec Settings:

  • Enable Virtual Path IPsec Tunnels for all Virtual Paths where FIPS compliance is required. IPsec settings for Virtual Paths are controlled via Default Sets.
  • Configure message authentication by changing the IPsec Mode to AH or ESP+Auth and use a FIPS approved hashing function. SHA1 is accepted by FIPS, but SHA256 is highly recommended.
  • IPsec lifetime should be configured for no more than 8 hours (28,800 seconds).

The Virtual WAN uses IKE version 2 with pre-shared-keys to negotiate IPsec tunnels through the Virtual Path using the following settings:

  • DH Group 19: ECP256 (256-bit Elliptic Curve) for key negotiation
  • 256-bit AES-CBC Encryption
  • SHA256 hashing for message authentication
  • SHA256 hashing for message integrity
  • DH Group 2: MODP-1024 for Perfect Forward Secrecy

To configure IPsec Tunnel for a third party, use the following settings:

  1. Configure FIPS approved DH Group. Groups 2 and 5 are permissible under FIPS, however groups 14 and above are highly recommended.

  2. Configure FIPS approved hash function. SHA1 is accepted by FIPS, however SHA256 is highly recommended.

  3. If using IKEv2, configure a FIPS approved integrity function. SHA1 is accepted by FIPS, however SHA256 is highly recommended.

  4. Configure an IKE lifetime, and max lifetime, of no more than 24 hours (86,400 seconds).

  5. Configure IPsec message authentication by changing the IPsec Mode to AH or ESP+Auth and use a FIPS approved hashing function. SHA1 is accepted by FIPS, but SHA256 is highly recommended.

  6. Configure an IPsec lifetime, and max lifetime, of no more than eight hours (28,800 seconds).

To configure IPSec tunnels:

  1. On the MCN appliance, go to Configuration > Virtual WAN > Configuration Editor. Open an existing configuration package. Go to Connections > IPSec Tunnels.

    localized image

  2. Go to Connections -> IPsec Tunnels. With LAN or Intranet Tunnel selected, the screen distinguishes the FIPS-compliant groups in the IKE settings from those that are not compliant, so that you can easily configure FIPS compliance.

    localized image

The screen also indicates whether the hash algorithm is FIPS compliant, as shown in the following figure.

localized image

FIPS compliance options for IPsec settings:

localized image

If the IPsec configuration does not comply with FIPS standards when it is enabled an audit error might be triggered. Following are the type of audit errors that get displayed in the GUI.

  • When, FIPS mode is enabled and Non-FIPS compliant option is selected.
  • When, FIPS mode is enabled and incorrect lifetime value is entered.
  • When, FIPS mode is enabled and IPsec settings for virtual path default set is also enabled, and incorrect Tunnel mode is selected (ESP vs ESP_Auth / AH).
  • When, FIPS mode is enabled, IPsec settings for virtual path default set are also enabled, and incorrect lifetime value is entered.
FIPS Compliance