c7000 OA FIPS mode settings

[tristar]

In the production system, current FIPS status is OFF.  I want to turn it ON to enforce strong communication.

OA user guide stated that to work on FIPS, need to clear VC settings first.

Question - I back up the VC configuration under FIPS OFF. When I clear the VC settings and turn on FIPS, and restore back the VC configuration.  Will it work?

[ManBha]

Hello,

Please do refer the below guide. You might have to re-configure the VC domain.

https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=a00112728en_us

However, you can try restoring using the VC CLI. [refer page 25]

https://support.hpe.com/hpesc/public/docDisplay?docId=a00102213en_us&docLocale=en_US

When creating a VCM backup file it is also recommended to create a human readable VCM configuration file (in VC CLI run the command SHOW ALL *).

Thanks.

[tristar]

Hi ManBha

You are right that in switching FIPS mode, need to manual setup through reconfiguration of the VC domain

I read the HPE Virtual Connect for c-Class BladeSystem User Guide in Appendix D, a section on FIPS mode information and guidelines that states clearly VC domain configuration file backed up in non-FIPS mode cannot be used in FIPS-enabled domain and vice versa..

Currently my customer c7000 OA is in non-FIPS mode (default setup), and now in production. The Nessus scan detected the OA using weak cipher and insecure SSL.

My customer wants to know if upgrade to higher firmware version can mitigate the vulnerabilities without wiping the VC domain configuration through changing FIPS mode..

Any feedback is very much appreciated.