I don't envy you. If you're using TrustSec and/or SDA, then the traditional PAC provisioning will fail after enabling FIPS. This process uses TLS 1.0 and FIPs mode disabled it. I recall MAB also stops working since PAP is not allowed in FIPS.
https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/admin_guide/b_ise_27_admin_guide/b_ISE_admin_27_basic_setup.html#ID395
"The certificates that are installed in Cisco ISE must be re-issued if the encryption method that is used in the certificates is not supported by FIPS.
When you enable the FIPS mode, the following functions are affected:
Cisco ISE enables FIPS 140 compliance via RADIUS shared secret and key management measures. When the FIPS mode is enabled, any function that uses a non-FIPS-compliant algorithm fails.
When you enable the FIPS mode:
-
All non-FIPS compliant cipher suites are disabled for EAP-TLS, PEAP, and EAP-FAST.
-
All non-FIPS compliant cipher suites are disabled in SSH.
-
Certificates and private keys must use only FIPS-compliant hash and encryption algorithms.
-
RSA private keys must be 2048 bits or greater.
-
ECDSA private keys must be 224 bits or greater.
-
ECDSA server certificate works with only TLS 1.2.
-
DHE ciphers work with DH parameters of 2048 bits or greater for all ISE TLS clients.
-
3DES ciphers are not allowed for Cisco ISE as a server
-
SHA-1 is not allowed for generating certificates.
-
SHA-1 is not allowed in client certificates.
-
The anonymous PAC provisioning option in EAP-FAST is disabled.
-
Local SSH server operates in FIPS mode.
-
The following protocols are not supported for RADIUS:
-
EAP-MD5
-
PAP
-
CHAP
-
MS-CHAPv1
-
MS-CHAPv2
-
LEAP
Once the FIPS Mode is enabled, all the nodes in the deployment are rebooted automatically. Cisco ISE performs a rolling restart by first restarting the primary PAN and then restarting each secondary node, one at a time. Hence, it is recommended that you plan for the downtime before changing the configuration."
