cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
804
Views
0
Helpful
7
Replies

Nexus 93180YC-FX and FIPS mode enabled and Disabled for Radius Hosts

pm.tinney
Level 1
Level 1

I am hoping someone can help me with something very annoying. We have a 4 Nexus 93180YC-FX switches running code version 10.3.3. In our environment, we must run FIPS and we must also run ISE 3.1 with Radius DTLS. I've discovered if the switch is running FIPS mode, there can be no radius-server host x.x.x.x statements. I get that. So I disabled FIPS and rebooted the switch. I still get the error that my radius-server host statements cannot be applied. The last time I ran into this, I backed up my config and did a write erase / reload. Then, my configuration for radius-server worked fine. The ultimate goal is to move from Radius, to radius DTLS using ISE and then enabling FIPS. My fear is, if I enable FIPS, I may never be able to make changes to my Radius-server hosts without having to do write erase / reload. What am I missing? Why is it when FIPS mode is Disabled, still causes issues when trying to modify or add/remove radius server hosts? Is there something else in the config that's causing this? Thanks...

4 Accepted Solutions

Accepted Solutions

balaji.bandi
Hall of Fame
Hall of Fame

have you checked the guide lines and Limitations :

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/93x/security/configuration/guide/b-cisco-nexus-9000-nx-os-security-configuration-guide-93x/m-configuring-fips.html

when you disable FIPS mode make sure you check the status - show fips status

Note : Since i have not deployed any FIPS based Image, since most of the use case for US Govt related, are you using this in US Govt and Military ?

 

 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

View solution in original post

I do have this very same guide, but it was written for 10.3.x code. We are a Govt facility so FIPS is mandatory.

View solution in original post

It costumer requirement, if he need fips then you need to make your network device run fips. 

These requirements is almost in USA. 

View solution in original post

if you are deploying in USA and FIPS has some Limitation as mentioned on the document, somehow you need to choose A vs B.

contact Cisco TAC better suggestion.

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

View solution in original post

7 Replies 7

balaji.bandi
Hall of Fame
Hall of Fame

have you checked the guide lines and Limitations :

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/93x/security/configuration/guide/b-cisco-nexus-9000-nx-os-security-configuration-guide-93x/m-configuring-fips.html

when you disable FIPS mode make sure you check the status - show fips status

Note : Since i have not deployed any FIPS based Image, since most of the use case for US Govt related, are you using this in US Govt and Military ?

 

 

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

I do have this very same guide, but it was written for 10.3.x code. We are a Govt facility so FIPS is mandatory.

It costumer requirement, if he need fips then you need to make your network device run fips. 

These requirements is almost in USA. 

if you are deploying in USA and FIPS has some Limitation as mentioned on the document, somehow you need to choose A vs B.

contact Cisco TAC better suggestion.

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

Not for FIPS for many network secuirty feature there is limitations. Include md5. 

Teddy Hartman
Level 1
Level 1

Has anyone been able to figure out how to reapply RADIUS after disabling FIPS without wiping the entire switch.  I disabled FIPS and rebooted and that doesn't work.

I was never able to reapply my Radius or Radius DTLS configuration with FIPS enabled or disabled. It required a full factory reset and then restore from a configuration that was backed up prior to the wipe of the switch. Cisco Security technical folks told me that it's a bug in the software. I have 6 Nexus 9000 switches and three needed factory reloads. But, once that's done, all works fine now.