Administration Guide › FIPS-140 Support › FIPS Support Overview

FIPS Support Overview

The Secure Proxy Server supports the requirements for cryptographic modules specified in the FIPS 140-2 standard. When you install SPS, a dialog appears that prompts you to select the level of FIPS support your operating configuration requires.

During a new installation you can select one of these three FIPS modes:

• COMPAT — Specifies that the installation is not FIPS-compliant. Select this mode when interacting with clients running earlier versions of SPS.
• MIGRATE — Specifies that SPS operates both with FIPS-compliant algorithms and algorithms used in earlier version of the SPSSPS simultaneously while the data is migrated.
• ONLY — Specifies that only FIPS-compliant algorithms are used and accepted by SPS. When you install in this mode, additional manual configuration is required.

The FIPS mode you select during installation usually is the same as the FIPS mode configured on the Policy Server.When the Policy Server is in Migrate mode, it can operate with SPS in any mode.

If you are upgrading an existing SPS installation, SPS continues to work as before, that is, in COMPAT mode. You can change the mode manually using the smreghost command, as described in subsequent sections. Be sure to restart the system after a mode change so that the Web Agent, SPS server, and the Apache server pick up the changes.

More information:

Migration to FIPS MIGRATE Mode

Configuration Process for FIPS ONLY Mode