How to tell if FIPS is enabled on C170 Appliance?

[Greg Hopp]

The upgrade notes from 7.6.3 to 8.0.x say FIPS will be disabled by default and you can enable/disable it and reissue certs after you upgrade.  I don't think we use FIPS now but I am not 100% positive, so how can I tell its current state on my Ironport?

Thank you,

Greg H.

[Alvaro J Gordon-Escobar · Accepted solution]

Hello Greg,

If you were running AsyncOS 7.6.x before the upgrade, or are still running it, you do not have to worry about this.  AsyncOS 7.3.x was the last version of AsyncOS that was both FIPs certified.    When upgrading from this older version to AsyncOS 8.0x,  FIPS will become disabled.  The Admin has to go  re-enabled FIPS once in AsyncOS 8.0.

The command to activate FIPS on AsyncOS 8.0.x for Email is fipsconfig.  

(Machine venetian-lab01.lab)> help fipsconfig

fipsconfig

    Configure FIPS mode.

If you are unsure if someone has activated teh feature, you can run the command, the preliminary output will inform you if it is active, or inactive.

(Machine venetian-lab01.lab)> fipsconfig

This command is restricted to "cluster" mode.  Would you like to switch to "cluster" mode? [Y]>

FIPS mode is currently disabled.

Choose the operation you want to perform:

- SETUP - Configure FIPS mode.

[]>

Best Regards,

-Alvaro

[Greg Hopp]

Thanks Alvaro, I confirm the fipsconfig is not even an available option in the CLI for 7.6.x.

Greg