The Cisco ACI must use FIPS 140-2/140-3 approved algorithms for authentication to a cryptographic module.

Unapproved mechanisms used for authentication to the cryptographic module are not validated and therefore, cannot be relied on to provide confidentiality or integrity, and DOD data may be compromised.

Cisco ACIs using encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules.

FIPS 140-2/140-3 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets DOD requirements. However, authentication algorithms must configure security processes to use only FIPS-approved and NIST-recommended authentication algorithms.

Satisfies: SRG-APP-000179-NDM-000265, SRG-APP-000411-NDM-000330, SRG-APP-000412-NDM-000331

1. Navigate to System >> System Settings. 2. Click "Fabric Security". 3. Click the "Policy" tab. 4. Verify FIPS Mode is set to "Enable".

If FIPS mode is not set to "Enable", this is a finding.

When FIPS is enabled, it is applied across the Cisco Application Policy Infrastructure Controller (APIC).

1. On the menu bar, select System >> System Settings. 2. In the Navigation pane, select "Fabric Security". 3. In the Work pane, in the Properties area, select the desired FIPS mode. 4. Reboot to complete the configuration.