Enable FIPS Mode on Catalyst 9300 Stack

[cls10378]

I have a Catalyst 9300 stack running IOSXE 17.9.4 and I am confused on how I can perform this, as stated in the FIPS guide here: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9200/software/release/17-9/configuration_guide/sec/b_179_sec_9200_cg/secure_operation_in_fips_mode.html

Enable secure stacking by configuring the same authorization key on each member of the stack.

In the past, you could do a session command to do that on a different stack member, but that has been depreciated.  Will I need to console into each switch and do this?  The stack is already established with 4 switches in the stack.

Been searching all over the web for the correct way to do this on a stack, but I am unable to really find anything.

[Flavio Miranda]

@cls10378 

On the document we can read

"

Note	Enable secure stacking by configuring the same authorization key on each member of the stack.

So, yes, you need to connect to every member and configure the same authorization key.

[cls10378]

Flavio, yes, but I wanted to know if the only way to do this now was via serial connection.  Sorry, if I wasn't 100% clear.  This location is 3 hours away in a different datacenter and I just wanted to accommodate that.

[Flavio Miranda · Accepted solution]

Considering stack switch, unfortunately console is the only way as there will be no direct access to stack member through the network. 

As we can see on the output for the command show romvar, FIPS will gather information from hardware and that´s why this need to be done per box. 

Device#show romvar

ROMMON variables:
PS1="switch: "
BOARDID="24666"
SWITCH_NUMBER="1"
TERMLINES="0"
MOTHERBOARD_ASSEMBLY_NUM="73-18506-02"
MOTHERBOARD_REVISION_NUM="04"
MODEL_REVISION_NUM="P2A"
POE1_ASSEMBLY_NUM="73-16123-03"

[cls10378]

Thanks for the quick response!  That gives me the direction we need to go in.