topic Re: FIPS 140-2 Certification in Cloud Networking Platform

FIPS 140-2 Certification

graberb — Wed, 22 Aug 2018 14:36:26 GMT

I would love to use the Meraki full stack in my environment but the network is subject to LEIN audits every three years. Devices that pass criminal justice information are required to hold a valid FIPS 140-2 certificate. I have heard from many sources that Meraki is in the process of acquiring these certs. Does anyone know more?

Re: FIPS 140-2 Certification

simple818 — Wed, 22 Aug 2018 15:14:56 GMT

I would like this too. It is a big hold up being to implement full stack Meraki in a Criminal Justice environment.

Re: FIPS 140-2 Certification

Philip D'Ath — Wed, 22 Aug 2018 20:12:11 GMT

I haven't heard of any rumours of Meraki applying for FIPS140-2 compliance (to be specific, FIPS140-2 relates to VPN and crypto).

However the 15.x code train (not available to the public yet) has significant changes on the VPN side - and perhaps those changes might make FIPS140-2 possible.

One significant issue is that FIPS140-2 is given to specific software versions. This would mean you could not upgrade the firmware to maintain compliance. This kinda violates the whole Merai principle where the software is kept up to date automatically for you.

The last part of this year is going to prove to be exciting in this area!

Re: FIPS 140-2 Certification

simple818 — Wed, 22 Aug 2018 20:23:56 GMT

@Philip D'Ath the encryption Meraki uses for its VPN tunnels is likely FIPS 140-2 compliant but getting the actual devices certified is what we'd be after. Cisco already does this with their ASA line of products and those have regular updates available. So I don't see why Cisco couldn't do this for its Meraki line of products as well. It cuts out a big chunk of law enforcement and criminal justice customers otherwise.

Re: FIPS 140-2 Certification

SunshineJulie — Mon, 08 Apr 2019 21:10:19 GMT

Adam,
Have you heard any more? I'm curious about this as well.

Re: FIPS 140-2 Certification

Philip D'Ath — Mon, 08 Apr 2019 21:44:09 GMT

>Cisco already does this with their ASA line of products and those have regular updates available

Note that specific software releases are certified FIPS140-2 for the ASA. You can not just upgrade the ASA software and maintain your FIPS140-2 certification.

Re: FIPS 140-2 Certification

LandrinLong — Wed, 02 Oct 2019 16:31:50 GMT

I have just heard a rumor...mind you it is just a rumor and is not substantiated at all, but I heard that Meraki devices will be on the FIPS 140-2 compliance list as soon as May of 2020.

Re: FIPS 140-2 Certification

bludwigj — Thu, 13 Feb 2020 16:32:31 GMT

I know it's not May yet but has anyone heard anything about the progress of FIPS?

Re: FIPS 140-2 Certification

LandrinLong — Thu, 13 Feb 2020 16:47:09 GMT

Due to confidentiality and non-disclosure agreements, I cannot share the content of the signed letter I received from an SVP in Meraki. I can tell you that though the Meraki devices may not be on the FIPS compliancy list by May, the intent is to be by May.

Re: FIPS 140-2 Certification

bludwigj — Thu, 13 Feb 2020 16:53:24 GMT

Can you share the SVP name? Thanks!

Re: FIPS 140-2 Certification

LandrinLong — Thu, 13 Feb 2020 21:17:36 GMT

Re: FIPS 140-2 Certification

thomasnorris — Wed, 22 Apr 2020 02:59:24 GMT

Has anyone heard any new information on this? I know it's not May yet. but at least it's been two months 🙂

Re: FIPS 140-2 Certification

LandrinLong — Wed, 22 Apr 2020 14:25:21 GMT

Since it is not May as you state, I have not heard anything more. I'm going to at least wait until then to start asking more questions.

Re: FIPS 140-2 Certification

ronald.stimbert — Tue, 19 May 2020 19:55:23 GMT

It is May! I have been tracking this thread for at least a year, and now that we are here I wanted to see if there were updates.

In a previous life as an MSP, Meraki was a great solution. In my current role, we must have FIPS to purchase, and our ASAs are due for replacement.

Please tell me there is a solution, or if one is on the roadmap still and when. I would prefer to purchase Meraki over the others but need to have this in the pocket before I can.

Re: FIPS 140-2 Certification

LandrinLong — Tue, 19 May 2020 19:59:33 GMT

From my rep at Meraki...

Here’s the synopsis of what we heard from Product Management yesterday:

FIPS 140-2 validation for AutoVPN network traffic has been delayed due to a software architectural issue with incorporating the FIPS validated object module that they were looking to use. As a result, we are looking at a minimum of 18 months before AutoVPN traffic will support FIPS 140-2 validation as they will likely have to certify a brand new hardware-based object module and this process alone takes around 12 months.
While FIPS for AutoVPN has been delayed, this software limitation will not delay the roadmap for FedRAMP certification. Development efforts are now being focused on achieving FedRAMP in progress (and certification) by using this object module for Meraki control traffic (mtunnel).

Re: FIPS 140-2 Certification

thomasnorris — Tue, 19 May 2020 20:02:00 GMT

So Fortinet it is.. who knows how long this next wait will be.. I can't risk further deployment of Meraki gear with this unknown not being handled in a reasonable amount of time.

Re: FIPS 140-2 Certification

ronald.stimbert — Tue, 19 May 2020 21:12:29 GMT

Thank you for that. A ton.

Meraki is obviously not following this thread. I spent a lot of time looking for roadmaps and news. They don't want to say "FIPS, the concept breaks our system and putting that burden on every customer for the DoD / DOJ / etc isn't worth it, ever." They should say that.

Cisco should step up and say "ASA and Firepower our our platforms for customers who require FIPS."

I will also be giving up on this, I don't have 15 more months to hope that they support it.

Re: FIPS 140-2 Certification

LandrinLong — Tue, 19 May 2020 21:54:14 GMT

That's your choice. I'll just continue to buy the cheapest FP1010 for FIPS and run Meraki everywhere else until Meraki gets up to speed. I love Meraki and their concepts. Now with the muscle of Cisco, I can wait. I'm patient.

Re: FIPS 140-2 Certification

ronald.stimbert — Tue, 19 May 2020 22:44:52 GMT

I wish I was in that situation. We aren't in a place where we could run two solutions. 99% of our employees and data requires protection.

Re: FIPS 140-2 Certification

martins@netxuk.com — Mon, 21 Dec 2020 15:27:59 GMT

I see that the Cisco website shows version 16 of the MX firmware as compliant. I've only seen version 15 so far (beta).

Here is the page on the Cisco site showing version 16 as compliant:

https://www.cisco.com/c/en/us/solutions/industries/government/global-government-certifications/fips-140.html

Is there a "special" beta of version 16 available? Is it perhaps just for some particular physical models?

Thanks