system fips-cc

Use this command to enable Federal Information Processing Standards-Common Criteria (FIPS-CC) mode. For information on compliance and certification, see also the FIPS 140-3 and Common Criteria Tech Note.

This enhanced security mode is required by some organizations, but may not be appropriate for others. It is valid only if you have installed a FIPS-certified firmware build on supported hardware. For more information on FIPS, or to obtain a certified build, contact Fortinet Technical Support.

When switching to FIPS mode, you will be prompted to confirm, and must log in again.

To disable FIPS mode, restore the firmware default configuration using factoryreset.

Back up the configuration before enabling FIPS mode. When you enable or disable FIPS-CC mode, all of the existing configuration is lost. For more information on making a complete backup, see the FortiMail Administration Guide.

Syntax

config system fips-cc

set status {disable | fips-ciphers}

set entropy-token {enable | disable | dynamic}

set reseed-interval <minutes_int>

end

Variable	Description	Default
entropy-token {enable | disable | dynamic}	Select the entropy token presence during random number generator (RNG) seeding.	dynamic
reseed-interval <minutes_int>	Enter the time interval in minutes to reseed the RNG. The valid range is from 0 to 1440 (24 hours).	1440
status {disable | fips-ciphers}	Enable or disable FIPS mode. When set to fips-ciphers, only a restricted set of ciphers are allowed for features requiring encryption such as SSL, TLS, and HTTPS. Other less secure protocols such as Telnet, TFTP, and HTTP access to the cloud FortiMail VM are not allowed.	disable

Related topics

profile encryption

system global

system security crypto

fips kat

log dummy-log

restore image