Fabric OS Administrator’s Guide 267
53-1002745-02
FIPS support
9
If FIPS mode is enabled, all logins should be handled through SSH or direct serial method, and the
transfer protocol should be SCP.
Updating the firmware key
1. Log in to the switch as admin.
2. Enter the firmwareKeyUpdate command and respond to the prompts.
The firmwareDownload command
The ipublic key file needs to be packaged, installed, and run on your switch before you download a
signed firmware.
When firmware download installs a firmware file, it must validate the signature of the file. Different
scenarios are handled as follows:
• If a firmware file does not have a signature, how it is handled depends on the
“signed_firmware” parameter on the switch. If it is enabled, firmware download fails.
Otherwise, firmware download displays a warning message and proceeds normally. When
downgrading to non-FIPS-compliant firmware, the “signed_firmware” flag needs to be disabled.
• If the firmware file has a signature but the validation fails, firmware download fails. This means
the firmware is not from Brocade, or the contents have been modified.
• If the firmware file has a signature and the validation succeeds, firmware download proceeds
normally.
SAS, DMM, and third-party application images are not signed.
Configuring a switch for signed firmware
1. Connect to the switch and log in using an account with admin permissions.
2. Enter the configure command.
3. Respond to the prompts as follows:
System Service Press Enter to select default setting; default is no.
ssl attributes Press Enter to select default setting; default is no.
snmp
attributes Press Enter to select default setting; default is no.
rpcd attributes Press Enter to select default setting; default is no.
cfgload
attributes
Select Yes. The following questions are displayed:
Enforce secure config Upload/Download: Select yes.
Enforce signed firmware download: Select yes.
Webtools
attributes Press Enter to select default setting; default is no.
System Press Enter to select default setting; default is no.
To Next Page
Loading...
Need help?
General