Nexus 93180YC-FX and FIPS mode enabled and Disabled for Radius Hosts

[pm.tinney]

I am hoping someone can help me with something very annoying. We have a 4 Nexus 93180YC-FX switches running code version 10.3.3. In our environment, we must run FIPS and we must also run ISE 3.1 with Radius DTLS. I've discovered if the switch is running FIPS mode, there can be no radius-server host x.x.x.x statements. I get that. So I disabled FIPS and rebooted the switch. I still get the error that my radius-server host statements cannot be applied. The last time I ran into this, I backed up my config and did a write erase / reload. Then, my configuration for radius-server worked fine. The ultimate goal is to move from Radius, to radius DTLS using ISE and then enabling FIPS. My fear is, if I enable FIPS, I may never be able to make changes to my Radius-server hosts without having to do write erase / reload. What am I missing? Why is it when FIPS mode is Disabled, still causes issues when trying to modify or add/remove radius server hosts? Is there something else in the config that's causing this? Thanks...

[balaji.bandi · Accepted solution]

have you checked the guide lines and Limitations :

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/93x/security/configuration/guide/b-cisco-nexus-9000-nx-os-security-configuration-guide-93x/m-configuring-fips.html

when you disable FIPS mode make sure you check the status - show fips status

Note : Since i have not deployed any FIPS based Image, since most of the use case for US Govt related, are you using this in US Govt and Military ?

[pm.tinney · Accepted solution]

I do have this very same guide, but it was written for 10.3.x code. We are a Govt facility so FIPS is mandatory.

[MHM Cisco World · Accepted solution]

It costumer requirement, if he need fips then you need to make your network device run fips. 

These requirements is almost in USA. 

[balaji.bandi · Accepted solution]

if you are deploying in USA and FIPS has some Limitation as mentioned on the document, somehow you need to choose A vs B.

contact Cisco TAC better suggestion.

[MHM Cisco World]

Not for FIPS for many network secuirty feature there is limitations. Include md5. 

[Teddy Hartman]

Has anyone been able to figure out how to reapply RADIUS after disabling FIPS without wiping the entire switch.  I disabled FIPS and rebooted and that doesn't work.

[pm.tinney]

I was never able to reapply my Radius or Radius DTLS configuration with FIPS enabled or disabled. It required a full factory reset and then restore from a configuration that was backed up prior to the wipe of the switch. Cisco Security technical folks told me that it's a bug in the software. I have 6 Nexus 9000 switches and three needed factory reloads. But, once that's done, all works fine now.