I need to enable fips remotely on a Cisco Nexus 9K

[DSterling]

I need to enable fips remotely the solution is to follow the below steps: 

Enable fips N9K
N9k-Switch# conf t
N9k-Switch(config)# no feature ssh
N9k-Switch(config)# no ssh key rsa
N9k-Switch(config)# ssh key rsa 2048
N9k-Switch(config)# feature ssh
New SSH Key has a bitcount of 2048:
N9k-Switch(config)# show ssh key (check RSA keys)
N9k-Switch(config)# fips mode enable (this required reload the switch)

The issue is that I need to do this remotely thru ssh and ssh will disconnect, I was thinking of a tcl script, but not too familiar with tcl scripting.

Is there a tcl or eem script that would work for this?

Thank you, Dave

[balaji.bandi]

What model of Nexus 9K, if you have chasis while booting with FIPS mode any failure cause it stops.

what the challange to get  the user available with console ?

yes you can use TCL/ EEM scripts where possible - but boot fail cause big cost.

[Georg Pauwen · Accepted solution]

Hello,

here is an EEM script you can run manually from the exec prompt (event manager run SSH_FIPS_ENABLE):

event manager applet SSH_FIPS_ENABLE
event none
action 1.0 cli command "enable"
action 2.0 cli command "configure terminal"
action 3.0 cli command "no feature ssh"
action 4.0 cli command "no ssh key rsa"
action 5.0 cli command "ssh key rsa 2048"
action 6.0 cli command "feature ssh"
action 7.0 cli command "show ssh key"
action 8.0 wait 5
action 9.0 cli command "fips mode enable"
action 10.0 cli command "end"
action 11.0 cli command "write memory"