the FIPS 140-2 Approved Security Functions publication. If FIPS 140-2 mode is
enabled, you may find that some of your existing clients can no longer communicate
with the management ports of the system if they do not support FIPS 140-2 Approved
cipher suites. FIPS 140-2 mode cannot be enabled on a storage system when non-
FIPS-compliant certificates exist in the certificate store. You must remove all non-
FIPS compliant certificates from the storage system before you enable the FIPS 140-2
mode.
Managing FIPS 140-2 mode on the storage system
Only the Administrator has the privileges to manage the FIPS 140-2 mode setting. Use
the following CLI command to set the FIPS 140-2 mode setting on a storage system:
uemcli /sys/security set -fips140Enabled yes will set it to FIPS 140-2 mode.
uemcli /sys/security set -fips140Enabled no will set it to non-FIPS 140-2
mode.
Use the following CLI command to determine the current FIPS 140-2 mode for the
storage system:
uemcli /sys/security show
When you change the FIPS 140-2 mode setting on a storage system, you must reboot
both SPs in order to apply the new setting. To do this, after changing the FIPS mode
setting, reboot one of the SPs (in Unisphere, go to Service > Service Tasks and
select Reboot for the SP). Wait for that SP's Status and Mode to change to OK and
Normal, respectively, which indicates that the SP has completed rebooting. When the
first SP has completed rebooting, reboot the other SP. The system will only operate
fully in the configured FIPS 140-2 mode after both SPs have completed rebooting.
Communication Security
50 EMC Unity All Flash, EMC Unity Hybrid, EMC UnityVSA 4.0 Security Configuration Guide
To Next Page
Loading...
Need help?
General
