Upgrading FIPS-enabled Devices

FIPS 140-3 compliance is a combination of implemented hardware procedures and the activation of a software-based security policy.

FIPS 140-3 certification is achieved when the device meets certain physical security and software conditions:

  • FIPS software compliance: The devices are configured to run in FIPS operational mode with the default FIPS security policy.
Note: Although commands to alter the FIPS security policy exist, altering the default FIPS security policy is not recommended.
Note: After enabling FIPS mode on your device, you cannot disable it without losing the device configuration. To disable FIPS mode, it is recommended that you contact RUCKUS Technical Support and perform the procedure under qualified guidance.

In this section:

  1. Preparing for a FIPS Software Upgrade
    Before upgrading the software on the device, consider the following important information and notes.
  2. Image Verification in FIPS or CC Mode
    For a FIPS- or CC-enabled device running FastIron 08.0.10 or later, uploading a flash or boot code triggers a FIPS Load Qualification test that performs a digital signature verification of the flash or boot code using a signature file. In earlier FastIron versions, the test is triggered only when the FIPS- or CC-enabled device boots.
  3. Performing a FIPS or CC Software Upgrade to FastIron 10.0.10d
    To upgrade the FastIron software image to FastIron 10.0.10d in support of a FIPS or CC environment, perform the following steps.
  4. SSH Connection after Upgrading a FIPS or CC Operational Device to FastIron 08.0.10 or Later
    If you are using key authentication for SSH connection, you should re-import the new format public keys into the device after upgrading a device in FIPS or CC operational mode.
Parent topic: Upgrading and Downgrading Software on FIPS-enabled Devices