FIPS 140-2 Certification

[graberb]

I would love to use the Meraki full stack in my environment but the network is subject to LEIN audits every three years. Devices that pass criminal justice information are required to hold a valid FIPS 140-2 certificate. I have heard from many sources that Meraki is in the process of acquiring these certs. Does anyone know more?

[simple818]

I would like this too. It is a big hold up being to implement full stack Meraki in a Criminal Justice environment.

[Philip D'Ath]

I haven't heard of any rumours of Meraki applying for FIPS140-2 compliance (to be specific, FIPS140-2 relates to VPN and crypto).

However the 15.x code train (not available to the public yet) has significant changes on the VPN side - and perhaps those changes might make FIPS140-2 possible.

One significant issue is that FIPS140-2 is given to specific software versions. This would mean you could not upgrade the firmware to maintain compliance. This kinda violates the whole Merai principle where the software is kept up to date automatically for you.

The last part of this year is going to prove to be exciting in this area!

[simple818]

@Philip D'Ath the encryption Meraki uses for its VPN tunnels is likely FIPS 140-2 compliant but getting the actual devices certified is what we'd be after. Cisco already does this with their ASA line of products and those have regular updates available. So I don't see why Cisco couldn't do this for its Meraki line of products as well. It cuts out a big chunk of law enforcement and criminal justice customers otherwise.

[SunshineJulie]

Adam,
Have you heard any more? I'm curious about this as well.

[Philip D'Ath]

>Cisco already does this with their ASA line of products and those have regular updates available

Note that specific software releases are certified FIPS140-2 for the ASA. You can not just upgrade the ASA software and maintain your FIPS140-2 certification.

[LandrinLong]

I have just heard a rumor...mind you it is just a rumor and is not substantiated at all, but I heard that Meraki devices will be on the FIPS 140-2 compliance list as soon as May of 2020.

[bludwigj]

I know it's not May yet but has anyone heard anything about the progress of FIPS?

[LandrinLong]

Due to confidentiality and non-disclosure agreements, I cannot share the content of the signed letter I received from an SVP in Meraki. I can tell you that though the Meraki devices may not be on the FIPS compliancy list by May, the intent is to be by May.

[bludwigj]

Can you share the SVP name? Thanks!

[LandrinLong]

[thomasnorris]

Has anyone heard any new information on this? I know it's not May yet. but at least it's been two months 🙂

[LandrinLong]

Since it is not May as you state, I have not heard anything more. I'm going to at least wait until then to start asking more questions.

[ronald.stimbert]

It is May! I have been tracking this thread for at least a year, and now that we are here I wanted to see if there were updates.

In a previous life as an MSP, Meraki was a great solution. In my current role, we must have FIPS to purchase, and our ASAs are due for replacement.

Please tell me there is a solution, or if one is on the roadmap still and when. I would prefer to purchase Meraki over the others but need to have this in the pocket before I can.

[LandrinLong]

From my rep at Meraki...

Here’s the synopsis of what we heard from Product Management yesterday:

1. FIPS 140-2 validation for AutoVPN network traffic has been delayed due to a software architectural issue with incorporating the FIPS validated object module that they were looking to use. As a result, we are looking at a minimum of 18 months before AutoVPN traffic will support FIPS 140-2 validation as they will likely have to certify a brand new hardware-based object module and this process alone takes around 12 months.
2. While FIPS for AutoVPN has been delayed, this software limitation will not delay the roadmap for FedRAMP certification. Development efforts are now being focused on achieving FedRAMP in progress (and certification) by using this object module for Meraki control traffic (mtunnel).