topic FIPS enable ASA 5515 - Port-Channel Break in Network Security

FIPS enable ASA 5515 - Port-Channel Break

aamsq11 — Fri, 21 Feb 2020 15:28:31 GMT

Current Setup: ASA 5515 - Active/Standby pair

Situation: Need to make currently running ASA 5515 FIPS complaint - cisco support said at least one port needs to be single port by itself before "fips enable" is implemented and not in port-channel.

We are thinking to break port channel interface that has outside and management sub-interfaces to it and assign these two sub-interfaces to single gig interface.

Question: would we lose any config related to outside and management interface?

Question: what is the best way to approach this re-config of the ASA? Example: break port channel or remove the single interface from port channel and configure that?

Question: do you have any experience with FIPS upgrade on currently working devices?

Re: FIPS enable ASA 5515 - Port-Channel Break

Marvin Rhoads — Tue, 06 Mar 2018 11:04:22 GMT

Anytime you need to reassign an interface you have to use "no nameif ___". that command will remove any associated ACLs and NAT commands that reference that nameif. As long as you know that in advance and take it into account you should be fine.

I've not done a FIPS conversion but I know there are several other requirements for compliance - the hardware anti-tamper kit as well as some operational procedures - that are required for full compliance.

Re: FIPS enable ASA 5515 - Port-Channel Break

aamsq11 — Tue, 06 Mar 2018 16:10:15 GMT

Thanks for the response Marvin. Since running the command "no nameif" will remove configuration then:

can we have a port-channel with only single interface being part of it? or will the port-channel break once we remove one interface out of the two it currently has?

Also, will the "no nameif" command remove any configs related to the interface like (VPN tunnels, digital certs, etc...) or just ACL and NATs?

Re: FIPS enable ASA 5515 - Port-Channel Break

Marvin Rhoads — Tue, 06 Mar 2018 16:32:22 GMT

You can have a portchannel with a single member.

When you "no nameif" an interface, the lines anywhere the nameif appears in the rest of the configuration will be removed. I mentioned the most common ones but the ones you mentioned and a few others would also be affected.