Converting a cluster to FIPS-CC

[bwsaloum]

Given all of the hurdles one has to go to to get a stand alone device converted to FIPS-CC, I'm told I have to do this on a cluster, so needless to say my anxiety is a bit on the "through the roof" side. Maybe I'm not looking hard enough, but I'm unable to find the steps for an active/passive cluster.  I'm assuming someone has already done this, so are there any pitfalls or gotcha's I need to look out for?

Thank you in advance!

bws

[Architect]

Hello Brian,

I have run through this exercise for FedRAMP compliance.  a few things that got us was converting your policy towards FIPS-CC first... this would reviewing all encryption used in your configuration and remove the weaker ciphers.  get ready to import/export your HA keys to each member.  DO NOT ever run with a FIPS-CC and non FIPS-CC cluster member.  This will result in the FIPS-CC member shutting down the other member.  

I would recommend importing your policy into a test cluster to get it ready for your FIPS-CC flip, it took us longer than expected as we had to remove and re-verify each option... rinse and repeat. 

Otherwise the cluster is fine, no more serial connection though 😉

[BPry]

@bwsaloum,

There's a ton of little gotcha moments when you enable FIPS-CC, but the only one that really changes with a HA pair is the requirement to utilize encryption on the HA setup. You'll definitely want to ensure you have that configured prior to actually changing the operational mode to avoid longer downtime and potential split-brain scenario due to the requirement not being met. 

I would really try and get your config loaded onto a lab box and verify that you have everything setup properly to FIPS-CC standards (proper cipher suites, ect) prior to actually making this cutover. This will make sure you don't have any extended outage re-configuring things to standard.  

[bwsaloum]

@BPry 

Thank you!  I was wondering about that while I was mocking up a couple of lab 220's into a cluster.  I guess the good thing I have going for me is that a couple of months ago, I upgraded all of my VPN crypto, so I shouldn't have to worry about that too much.  I'm going to give pre-encrypting my HA1 prior to the conversion to FIPS.