Product Documentation

FIPS Compliance

Mar 01, 2018

In SD-WAN, FIPS mode enforces users to configure FIPS compliant settings for their IPsec Tunnels and IPsec settings for Virtual Paths.

  • Displays the FIPS compliant IKE Mode.
  • Displays a FIPS Compliant IKE DH Group from which users can select the required parameters for configuring the appliance in FIPS compliant mode (2,5,14 – 21).
  • Displays the FIPS compliant IPsec Tunnel Type in IPsec settings for Virtual Paths

        a.    IKE Hash and (IKEv2) Integrity mode, IPsec auth mode.

        b.    Performs audit errors for FIPS based Lifetime Settings

To enable FIPS compliance by using the NetScaler SD-WAN GUI:

1.    Go to Configuration -> Virtual WAN -> Configuration Editor - > Global, and select Enable FIPS Mode.

Enabling FIPS mode enforces checks during configuration to ensure that all IPsec related configuration parameters adhere to the FIPS standards. You will be prompted through audit-errors and warnings to successfully configure IPsec to meet the standards.

To configure Virtual Path IPsec Settings:

  • Enable Virtual Path IPsec Tunnels for all Virtual Paths where FIPS compliance is required. IPsec settings for Virtual Paths are controlled via Default Sets.
  • Configure message authentication by changing the IPsec Mode to AH or ESP+Auth and use a FIPS approved hashing function. SHA1 is currently accepted by FIPS, but SHA256 is highly recommended.
  • IPsec lifetime should be configured for no more than 8 hours (28800 seconds).

The Virtual WAN uses IKE version 2 with pre-shared-keys to negotiate IPsec tunnels through the Virtual Path using the following settings:

  • DH Group Group 19: ECP256 (256-bit Elliptic Curve) for key negotiation
  • 256-bit AES-CBC Encryption
  • SHA256 hashing for message authentication
  • SHA256 hashing for message integrity
  • DH Group 2: MODP-1024 for Perfect Forward Secrecy

To configure IPsec Tunnel for a third party, use the following settings:

  1. Configure FIPS approved DH Group. Groups 2 and 5 are permissible under FIPS, however groups 14 and above are highly recommended.

  2. Configure FIPS approved hash function. SHA1 is currently accepted by FIPS, however SHA256 is highly recommended.

    If using IKEv2, configure a FIPS approved integrity function. SHA1 is currently accepted by FIPS, however SHA256 is highly recommended.

  3. Configure an IKE lifetime, and max lifetime, of no more than 24 hours (86400 seconds).

  4. Configure IPsec message authentication by changing the IPsec Mode to AH or ESP+Auth and use a FIPS approved hashing function. SHA1 is currently accepted by FIPS, but SHA256 is highly recommended.

  5. Configure an IPsec lifetime, and max lifetime, of no more than 8 hours (28800 seconds).

To configure IPSec tunnels:

  1. On the MCN appliance, go to Configuration -> Virtual WAN -> Configuration Editor. Open an existing configuration package. Go to Connections > IPSec Tunnels.

    localized image

  2.  Go to Connections -> IPsec Tunnels.  With LAN or Intranet Tunnel selected, the screen distinguishes the FIPS-compliant groups in the IKE settings from those that are not compliant, so that you can easily configure FIPS compliance.

    localized image

The screen also indicates whether the hash algorithm is FIPS compliant, as shown in the following figure.

localized image

FIPS compliance options for IPsec settings:

localized image

If the IPsec configuration does not comply with FIPS standards when it is enabled an audit error might be triggered. Following are the type of audit errors that get displayed in the GUI.

  • When FIPS mode is enabled and Non-FIPS compliant option is selected.
  • When FIPS mode is enabled and incorrect lifetime value is entered.
  • When FIPS mode is enabled and IPsec settings for virtual path default set is also enabled, and incorrect Tunnel mode is selected (ESP vs ESP_Auth / AH).
  • When FIPS mode is enabled, IPsec settings for virtual path default set is also enabled, and incorrect lifetime value is entered.

FIPS Compliance

In this article