--- title: "Enabling / Disabling the CC Mode and FIPS Mode" canonical: "https://docs.infoblox.com/space/niosfipscc/1458536909/Enabling%20%2F%20Disabling%20the%20CC%20Mode%20and%20FIPS%20Mode" format: markdown --- > ⚠️ **Note** > ⚠️ > ⚠️ Infoblox recommends that you do not change the Common Criteria or FIPS setting of a NIOS appliance that is in a production environment. NIOS 9.0.7 or later is supported in the FIPS and CC-NIAP (National Information Assurance Partnership) mode. However, FIPS 140-3 and Common Criteria certifications are currently pending. This topic explains how to enable or disable the Common Criteria (CC) or the Federal Information Processing Standard (FIPS) 140-3 security standards mode in NIOS. It also lists the Infoblox appliances that can be made Common Criteria or FIPS compliant. You can enable the FIPS/CC mode in the following setups: - In a Grid setup, you can set the FIPS/CC mode only on the Grid Master. The setting is propagated to all Grid members during the joining process. After the configuration is changed, Grid members are restarted. - You can set the FIPS/CC mode on standalone systems. - In a high availability (HA) setup, you can set the FIPS/CC mode only on the standalone Grid Master, and then configure it as a node in the HA pair. Perform the same sequence of steps for the second node of the HA pair. You cannot change the FIPS/CC mode setting on the HA Grid Master or on the HA member. # Restoring the NIOS Appliance to its Factory Settings Prerequisite Before you enable the Common Criteria or the FIPS mode, you must reset the NIOS appliance to its original factory settings. This removes the database, network settings, logs, and configuration files. The appliance then restarts with its factory settings, which are the default user name, password, and default network settings. If you do not reset the appliance to its original factory settings, the appliance will not be Common Criteria or FIPS compliant even if you enable the Common Criteria or the FIPS mode, respectively. > ⚠️ **Note** > ⚠️ > ⚠️ - Only superusers can access the CLI. To ensure security, access to the CLI is permitted through a direct console connection only. Activating the **Enable** **Remote** **Console** **Access** option in the *Grid Properties Editor* or in the *Member Properties Editor* results in a non-compliant system. For instructions to access the CLI through a console port, see *[Console Port Access](https://infoblox-docs.atlassian.net/wiki/spaces/nios86/pages/1105005631)*. > ⚠️ - After you log in, change the default user name and password of the default superuser admin to prevent unauthorized access to the CLI. For more information on changing passwords, see *[Changing the Password and Email Address](https://infoblox-docs.atlassian.net/wiki/spaces/nios86/pages/1101824006)*. To reset the NIOS appliance to its factory settings, complete the following steps: 1. Log in to the NIOS CLI using a superuser account. 2. Run the following CLI command: `reset all` # Algorithms in the FIPS/CC Mode In the default mode with FIPS/CC enabled, if you wish to enable or disable specific algorithms, you must switch to the override mode, where you can manage both algorithm settings and the compliance mode. If you are upgrading to version 9.0.7 (or later) with FIPS/CC enabled in the default mode, you must switch to the override mode and adjust the settings as needed. The following algorithms are not recommended as they are not compliant to FIPS 140-3: 1. DES-CBC-MD5 2. DSA 3. RSASHA1 4. MD5 5. TLS1.0 and TLS 1.1 # Port Settings for FIPS/CC Compliance Following is a list of port usage with the communication types used in FIPS/CC mode: - 22 - OpenVPN server port used for Grid communication, both with and without Secure Shell (SSH) tunnel. - 1023 - OpenVPN server port used for the passive node to connect with the active node only when when the Grid member is in HA mode. When the Grid Master is in HA mode, the passive node communicates with the active node only on port 1194. - 9994/9993 - OpenVPN remote port to which members connect through the SSH tunnel. These ports are used locally on the client/member side as SSH tunnel listening points, forwarding OpenVPN traffic to the remote server. They do not need to be opened for firewall purposes. - 2294 - Local port of the Grid member used to connect to the Grid Master's OpenVPN server port during the SSH tunnel setup. The passive node also uses the same port number to communicate with the active node even when it is an HA member. 2294 is the local port that the Grid member binds to for sending outbound traffic. - 21197 - Network Insight probe OpenVPN port to connect with the consolidator. # Enabling / Disabling the CC Mode You can enable or disable the Common Criteria mode only from the NIOS CLI. To set the Common Criteria mode on an appliance, complete the following steps: 1. Log in to the NIOS CLI using the default superuser account with credentials: Name: **admin** Password: **infoblox**. 2. Run the `reset all` command to reset the system. 3. Configure the network and license requirements. 4. Change the shared secret key of the Grid to **20** by using Grid Manager or WAPI. The shared secret key can be a value in the range of 20 and 64. Note: The shared secret is the code that you entered in the *Grid Setup Wizard* when creating the Grid Master. 5. Run the `set cc_mode` command to set the CC mode. 6. When prompted with `Enable CC Mode?`, type `y` to enable the CC mode or `n` to disable it. - Example for enabling the CC mode: `Infoblox > set cc_mode ` `Enable Common Criteria mode? (y or n): y` `New Common Criteria Mode Settings:` `    Common Criteria mode enabled: Yes` `        is this correct? (y or n):  y` `Please refer to the Guidance Documentation Supplement Appendix of the ` `NIOS Administrator Guide for the requirements to operate a grid in a common criteria compliant manner.` `WARNING: Enabling FIPS/CC mode will clear any existing join token data and disable` `Cloud connections.` `The system will be rebooted to place it into common criteria mode.` `Are you sure you want to continue (y or n): y` `Integrity private key and certificate were generated successfully.` `Sign executable files by sha256sum... done.` ` ` `All cloud based services/connections have been disabled for FIPS/CC mode.` ` ` `SYSTEM REBOOTING!` - Example for disabling the CC mode: `Infoblox > set cc_mode` `Enable Common Criteria mode? (y or n): n` `New Common Criteria Mode Settings:` ` Common Criteria mode enabled: No` ` is this correct? (y or n): y` `This will reboot the system. Are you sure you want to continue (y or n): y` The CLI reboots and goes through boot-time self tests. If the test fails, the CLI goes into a loop and displays an error message on the serial console and the LCD. Otherwise, it displays the login prompt after the self tests. > ⚠️ **Note** > ⚠️ > ⚠️ To clear the Common Criteria mode from an appliance, log in to the NIOS CLI and run the following command: > ⚠️ `reset all` # Enabling / Disabling the FIPS Mode You can enable or disable the FIPS mode only from the NIOS CLI. To set the FIPS mode on an appliance, complete the following steps: 1. Log in to the NIOS CLI. 2. Run the `reset all` CLI command. After executing this command, you can log in to the CLI only by using the default superuser admin name **admin** and password **infoblox**. 3. Add the network and license requirements. 4. Change the shared secret key of the Grid by using the Grid Manager or WAPI. The shared secret is the secret code that you entered in the *Grid Setup Wizard* when creating the Grid Master. 5. Type the `set fips_mode` command. When prompted with `Enable FIPS Mode?`, type `y` to enable the FIPS mode or `n` to disable it. See the following example: `Infoblox > set fips_mode` `Enable FIPS mode? (y or n): yNew FIPS Mode Settings:` `  FIPS mode enabled: Yes` `    is this correct? (y or n): y` `Please refer to the Guidance Documentation Supplement Appendix of the` `NIOS Administrator Guide for the requirements to operate a grid in a FIPS compliant manner.` `The system will be rebooted to place it into FIPS mode.` `Are you sure you want to continue (y or n): y` `Integrity private key and certificate were generated successfully.` `Sign executable files by sha256sum...` When you enable the FIPS mode, the NIOS appliance restarts and goes through boot-time self tests. If the tests fail, the appliance goes into a loop and displays an error message on the serial console and the LCD. Otherwise, it displays the login prompt after completing the self tests. For user name - admin, enabling FIPS mode will prompt you to change your password, in a new Grid, if the password is not changed before enabling FIPS mode. To migrate the Grid communication between the Grid Master and members to an FIPS/CC compliant state, use the *[set distributed_grid_comm_mode](https://infoblox-docs.atlassian.net/wiki/spaces/nios86draft/pages/1014628369)* command and to display if a NIOS Grid is in the FIPS/CC compliant mode or not, use the *[show distributed_grid_comm_mode](https://infoblox-docs.atlassian.net/wiki/spaces/nios86draft/pages/1014202392)* command. > ⚠️ **Note** > ⚠️ > ⚠️ - To clear the FIPS mode from an appliance, log in to the NIOS CLI and run the following command: > ⚠️ `reset all.` > ⚠️ - You can enable password security such that if a group user tries to log in to Grid Manager by using an incorrect password, NIOS locks the account (CLI and Grid Manager) for a configured time period. For more information on lockout, see *[Configuring Account Lockout for Admin Groups](https://infoblox-docs.atlassian.net/wiki/spaces/nios86draft/pages/26774316)*. # Upgrade Guidelines in FIPS mode - On a FIPS-enabled mode, during a fresh installation or after an upgrade, you are now prompted to change the password for the default ‘admin’ user (only for the first login) even if it was changed in the previous versions. - However, if FIPS mode is not enabled during the upgrade, consider the following if you wish to enable FIPS mode post upgrade: - If you change the password for the username - admin before enabling FIPS mode, no further password change is needed after enabling FIPS mode. - If you do not change the password for the username - admin before enabling FIPS mode, you will need to change the password after enabling FIPS mode. - On a FIPS-enabled mode, during a staged upgrade, after the Grid Master is upgraded, the changed password for the 'admin' user will not propagate to the members that are waiting to upgrade until those members are upgraded. - If FIPS is enabled on a Grid, upon an upgrade, Grid communication is not automatically in the FIPS-compliant mode. Run the `set distributed_grid_comm_mode` CLI command to get the Grid communication in the compliant mode. A banner is displayed in Grid Manager until NIOS transitions into the FIPS/CC compliant mode. For more information about the command, see *[set distributed_grid_comm_mode](https://infoblox-docs.atlassian.net/wiki/spaces/nios86draft/pages/1014628369)**.* - When upgrading from a lower version FIPS/CC-enabled Grid to 9.0.7 or later, the following changes take place: - The upgrade test fails if the TLS versions 1.0 and 1.1 are enabled, and to pass the upgrade test, TLS 1.0 and TLS 1.1 must be disabled. - The upgrade test fails if the Grid’s shared secret length is below 20 characters. - Downgrading to NIOS versions earlier than 8.5.5 or 8.6.1 is not recommended when FIPS/CC mode is enabled. - When upgrading FIPS/CC-enabled Grids to NIOS 9.0.7 or later, if there are cloud connections present in the Grid, they will be disabled and the respective join token will be deleted. - When upgrading FIPS/CC-enabled Grids to NIOS 9.0.7 or later, or on a freshly-installed FIPS/CC-enabled Grid, if the Grid is in the non-compliant mode, the existing yellow banner message has been revised as follows: The Grid and secure communication between the Grid Master and its members are currently in a non-compliant state. To ensure FIPS and CC compliance, please enable all relevant configurations and execute the `set distributed_grid_comm_mode` CLI command. For more details, see *[set distributed_grid_comm_mode](https://infoblox-docs.atlassian.net/wiki/spaces/niosfipscc/pages/1458765982)*. # Common Criteria and FIPS Compliant Appliances All of the Trinzic X5 and X6 Series appliances can be made FIPS 140-3 compliant and Common Criteria compliant.