Entering Common Criteria Administrative Mode

Use the following command to enter Common Criteria mode.

device(config)# fips enable common-criteria

Syntax: [no] fips enable common-criteria

The following example includes the detailed banner that is displayed after you enter the command.

device# configure
device(config)# fips enable common-criteria
CLI-FIPS: Common Criteria is enabled with FIPS status Disabled

FIPS: Disabling HTTP..HTTP already disabled

FIPS: Disabling Telnet..
Error - No active TELNET sessions

FIPS: Disabling Tftp..

FIPS: Deleting SSH Keys..RSA Key pair is successfully deleted

FIPS: Disabling HTTP..HTTP already disabled

FIPS: Disabling Telnet..

SYSLOG: <14> Apr 15 12:50:53 ICX7150-48 Router Crypto: RSA Key pair is successfully deleted   
Error - No active TELNET sessions

FIPS: Disabling Tftp..
tftp disable set already.

FIPS: Deleting SSH Keys..RSA Key pair not found
This device is now running in CC administrative mode.
At this time you can alter this system's CC default security policy
and then enter CC operational mode.

Note: Making changes to the default policy makes the device non-compliant
with CC and FIPS 140-3 Level 1, design assurance Level 1          
The default security policy defined in the FIPS
Security Policy Document ensures that the device complies with all
FIPS 140-3 specifications. Commands to alter the default security policy
are available to the crypto-officer; however, Ruckus Wireless does not recommend
making changes to the default security policy at any time.
=====================================

To enter CC mode, complete the following steps:
1. Optionally, configure FIPS policy commands that meets your network
   requirements. You must explicitly configure the following services if you
   want to use them when the device is operational in CC mode:
2. Enter the "fips zeroize all" command, which zeroes out the shared secrets
    used by various networking protocols, including the host access passwords,
    SSH and HTTPS host-keys with the digital signature based on the configured 
    FIPS Security Policy. If SSH ReKey Exchange value was not configured then
    the default value of 30Mins and 500MB will be configured
3. Save the running configuration.
4. Reload the device.
5. Do not press "b" during reload, else FIPS or CC will not be enabled properly.
6. Enter the "fips show" command to verify that the device entered
    FIPS or CC operational mode.
=====================================

The system will disable the following services or commands after reload:
1. Telnet server will be disabled. The "telnet server" command will be removed.
2. SCP will be enabled. The "ip ssh scp disable" command will be removed.
3. HTTP server will be disabled. The "web-management http" command will be removed.
Passwords/Keys which dont comply FIPS standards will be removed on reload.
aaa authentication method must be configured.
Disabling user when invalid password is entered is default in FIPS and above modes.
Default value of login recovery time is 3 secs.
No command sets the login recovery time to 3 secs and disables the user after 3 invalid attempts.
Default values of 3 attempts and 3 secs are not displayed in running config.
Please see FIPS config guide for complete details.
=====================================
Additionally, in CC mode, the system will disable the following
services or commands after reload:
UDP Syslog servers will be deleted from configuration(only in the CC operational mode).
DSA keys will be deleted from configuration, and will be disabled .
RSA key sizes will be restricted to 2048 and above in the configuration. 
Non-TLS TACACS+ servers will be disabled from configuration.
For SSH Key Exchange, only diffie-hellman-group14 algorithm is allowed.