Converting a cluster to FIPS-CC

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L1 Bithead

Converting a cluster to FIPS-CC

Given all of the hurdles one has to go to to get a stand alone device converted to FIPS-CC, I'm told I have to do this on a cluster, so needless to say my anxiety is a bit on the "through the roof" side. Maybe I'm not looking hard enough, but I'm unable to find the steps for an active/passive cluster.  I'm assuming someone has already done this, so are there any pitfalls or gotcha's I need to look out for?

 

Thank you in advance!

 

bws

Highlighted
L0 Member

Hello Brian,

 

I have run through this exercise for FedRAMP compliance.  a few things that got us was converting your policy towards FIPS-CC first... this would reviewing all encryption used in your configuration and remove the weaker ciphers.  get ready to import/export your HA keys to each member.  DO NOT ever run with a FIPS-CC and non FIPS-CC cluster member.  This will result in the FIPS-CC member shutting down the other member.  

 

I would recommend importing your policy into a test cluster to get it ready for your FIPS-CC flip, it took us longer than expected as we had to remove and re-verify each option... rinse and repeat. 

 

Otherwise the cluster is fine, no more serial connection though

 

 

Highlighted
Cyber Elite

@brian.saloum,

There's a ton of little gotcha moments when you enable FIPS-CC, but the only one that really changes with a HA pair is the requirement to utilize encryption on the HA setup. You'll definitely want to ensure you have that configured prior to actually changing the operational mode to avoid longer downtime and potential split-brain scenario due to the requirement not being met. 

I would really try and get your config loaded onto a lab box and verify that you have everything setup properly to FIPS-CC standards (proper cipher suites, ect) prior to actually making this cutover. This will make sure you don't have any extended outage re-configuring things to standard.  

Highlighted
L1 Bithead

@BPry 

Thank you!  I was wondering about that while I was mocking up a couple of lab 220's into a cluster.  I guess the good thing I have going for me is that a couple of months ago, I upgraded all of my VPN crypto, so I shouldn't have to worry about that too much.  I'm going to give pre-encrypting my HA1 prior to the conversion to FIPS.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!