Title

The Cisco ACI must use FIPS 140-2/140-3 approved algorithms for authentication to a cryptographic module. (Cat I impact)

Discussion

Unapproved mechanisms used for authentication to the cryptographic module are not validated and therefore cannot be relied on to provide confidentiality or integrity, and DOD data may be compromised. Cisco ACIs using encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2/140-3 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets DOD requirements. However, authentication algorithms must configure security processes to use only FIPS-approved and NIST-recommended authentication algorithms. Satisfies: SRG-APP-000179-NDM-000265, SRG-APP-000411-NDM-000330, SRG-APP-000412-NDM-000331

Check Content

1. Navigate to System >> System Settings. 2. Click "Fabric Security". 3. Click the "Policy" tab. 4. Verify FIPS Mode is set to "Enable". If FIPS mode is not set to "Enable", this is a finding.

Fix Text

When FIPS is enabled, it is applied across the Cisco Application Policy Infrastructure Controller (APIC). 1. On the menu bar, select System >> System Settings. 2. In the Navigation pane, select "Fabric Security". 3. In the Work pane, in the Properties area, select the desired FIPS mode. 4. Reboot to complete the configuration.

Additional Identifiers

Rule ID: SV-271966r1067375_rule

Vulnerability ID: V-271966

Group Title: SRG-APP-000179-NDM-000265

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.