Activation of FIPS mode on C9120AX Access point

[jguittet]

Hello,

I have a Cisco C9120AX Access Point and I would like to activate the FIPS mode.

I have not seen any menu for that on the web page of the Access point, and not found the wanted command on the serial interface (I guess it is possible at least by this interface ?) I only seen on the AP dashboard that the FIPS mode is disabled actually.

Firmware is 16.12.04a (not the latest I think), but if possible I would like to keep this one to avoid any other issues/modifications/setup to redo etc.

Thanks for any information!

Regards,

J. GUITTET

[Rich R · Accepted solution]

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/16-12/config-guide/b_wl_16_12_cg/fips.html
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/m-fips.html

[jguittet]

@Rich R thanks. Can you point some documentation about FIPS mode on this device to understand what is FIPS, what is not FIPS when FIPS mode is activated ? My customer ask me to detail what activating FIPS exactly means. Just for the context: e develop a device with FIPS and currently testing FIPS compatibility in general.

[Rich R]

The certificate links I provided on your other post list which components are FIPS certified by Cisco and then you would have to refer to the FIPS standards for what that means.

For example 17.9 EWC: https://www.cisco.com/c/dam/en_us/solutions/industries/government/security_certification/pdfs/ewc-internal-compliance-letter-17-9-signed.pdf
A conformance review of Cisco Embedded Wireless Controllers with software version 17.9 was completed and found
that the Product integrates the following FIPS 140-2 approved cryptographic module:
1. Cisco FIPS Object Module (FIPS 140-2 Cert. #4036)
2. IOS Common Cryptographic Module (IC2M) Rel 5a (FIPS 140-2 Cert. #4222)
Cisco confirmed that the following features leverage the embedded cryptographic module to provide
cryptographic services for SSH, TLS, DTLS, and SNMPv3:
1. Session establishment supporting each service,
2. All underlying cryptographic algorithms supporting each services’ key derivation functions,
3. Hashing for each service,
4. Symmetric encryption for each service.