Enable or Disable FIPS Mode in Sensor Management Docker

Beginning with release 25.07, Cisco Crosswork Assurance Sensor Management operates in two modes: FIPS mode and non-FIPS mode. Each mode has specific requirements and capabilities.

FIPS (Federal Information Processing Standard) is a government standard that specifies security requirements for cryptographic modules.

Operating System-Level FIPS Mode Support

• Red Hat 9.6

For Red Hat 9.6

Prerequisite: Install FIPS modules before enabling or disabling FIPS mode.
To check whether FIPS mode is enabled on the operating system, run:

fips-mode-setup --check

The output should display "FIPS mode is enabled".

Note: If the output shows "Installation of FIPS modules is not completed," you must install the FIPS modules before proceeding. Refer to Red Hat's guide on Switching RHEL to FIPS mode for installation instructions.

If FIPS mode is disabled, follow these steps to enable it:

sudo fips-mode-setup --enable
sudo reboot

Operating System-Level Non-FIPS Mode Support

• Ubuntu 24.04
• Red Hat 9.6

For Ubuntu 24.04
The operating system-level FIPS mode in Ubuntu 24.04 is disabled by default.

For Red Hat 9.6

Prerequisite: Install FIPS modules before enabling or disabling FIPS mode.
To check whether FIPS mode is disabled on the operating system, run:

fips-mode-setup --check

The output should display "FIPS mode is disabled".

Note: If the output shows "Installation of FIPS modules is not completed," you must install the FIPS modules before proceeding. Refer to Red Hat's guide on Switching RHEL to FIPS mode for installation instructions.

If FIPS mode is enabled, follow these steps to disable it:

sudo fips-mode-setup --disable
sudo reboot

Enabling FIPS Mode on Cisco Crosswork Assurance Sensor Management

Cisco Crosswork Assurance Sensor Management in FIPS mode complies with Federal Information Processing Standards (FIPS) and is designed to manage FIPS-compliant devices (versions 25.07 and above).
Notes:

• TLS version 1.0 and TLS version 1.1 are not supported.
• TLS version 1.2 and TLS version 1.3 are supported.

To enable the Cisco Crosswork Assurance Sensor Management FIPS mode

1. Log in to smcli by SSH into to the Cisco Crosswork Assurance Sensor Management via port 2200 as skylight user.
2. Stop the Cisco Crosswork Assurance Sensor Management services:

service stop

When prompted, enter:

y

3. Enable the Cisco Crosswork Assurance Sensor Management FIPS mode by entering the following command:

fips edit state enable

The output will display "The new FIPS configuration will be applied after restarting smcli service".
4. Start the Cisco Crosswork Assurance Sensor Management services:

service start

When prompted, enter: y
5. Exit the smcli

exit

6. Restart the smcli service on the Docker host to apply the change:

sudo systemctl restart sm.climgr.service

7. Log back in to smcli by SSH into Cisco Crosswork Assurance Sensor Management via port 2200 as skylight user.
8. Verify that all Cisco Crosswork Assurance Sensor Management FIPS mode statuses show Enabled in smcli:

   fips show
   

   The output status should display "Enabled" as below:

   sm-cli: fips show 
   
   FIPS administrative status:                                          Enabled
   CLIMGR FIPS operational status:                                      Enabled
   Cisco Crosswork Assurance Sensor Management FIPS operational status: Enabled
   

Disabling FIPS Mode on Cisco Crosswork Assurance Sensor Management

By default, Cisco Crosswork Assurance Sensor Management operates in non-FIPS mode after deploying a fresh installation.

To disable the Cisco Crosswork Assurance Sensor Management FIPS mode

1. Log in to smcli by SSH into to the Cisco Crosswork Assurance Sensor Management via port 2200 as skylight user.
2. Stop the Cisco Crosswork Assurance Sensor Management services:

   service stop
   

When prompted, enter:

y

3. Disable the Cisco Crosswork Assurance Sensor Management FIPS mode by entering the following command:

   fips edit state disable
   

The output will display:

Removing existing Cisco Crosswork Assurance Sensor Management containers ...
so-mysql-<version>
so-nbin1-<version>
so-medn1-<version>
so-core-<version>
The new FIPS configuration will be applied after restarting smcli service.

4. Start the Cisco Crosswork Assurance Sensor Management services:

   service start
   

   When prompted, enter: y

5. Exit the smcli

   exit
   

6. Restart the smcli service on the Docker host to apply the change:

   sudo systemctl restart sm.climgr.service
   

7. Log back in to smcli by SSH into Cisco Crosswork Assurance Sensor Management via port 2200 as skylight user.

8. Verify that all Cisco Crosswork Assurance Sensor Management FIPS mode statuses show Disabled in smcli:

   fips show
   

   The output status should display "Disabled" as below:

   Skylight: fips show 
   FIPS administrative status:                    Disabled
   CLIMGR FIPS operational status:                Disabled
   Cisco Crosswork Assurance Sensor Management FIPS operational status: Disabled