Administer > Security Configuration > Configuring NNMi to Use FIPS 140-2-Validated Cryptographic Modules

Configuring NNMi to Use FIPS 140-2-Validated Cryptographic Modules

This section explains how to configure NNMi to use Federal Information Processing Standards (FIPS) 140-2-validated cryptographic modules. FIPS guidelines provide a standard for security requirements for cryptographic modules defined by the National Institute of Standards Technology (NIST). This section explains how to configure NNMi to use cryptographic modules that are compliant with FIPS requirements.

Note You can configure only NNMi Premium (that is NNMi, NNM iSPI Performance for Metrics, and NNM iSPI Performance for QA) to be FIPS-compliant.

To be able to meet the requirements of the FIPS 140-2 standards, NPS and NNMi must be installed on the same server.

A new installation of NNMi 10.30 uses FIPS 140-2-validated cryptographic module (RSA BSAFE) for encryption and key management and supports Public Key Cryptography Standards #12 (PKCS #12) certificates. A new command—nnmkeytool.ovpl—helps in managing this PKCS #12 certificates. For more information about managing new PKCS #12 certificates, see the Managing Certificates section in the NNMi Deployment Reference.

In an upgraded NNMi environment, FIPS-compliant ciphers and algorithms are automatically used for most password encryption and network communication procedures. However, some legacy ciphers and algorithms do exist in the upgraded environment that do not meet FIPS guidelines.

To achieve the highest level of FIPS 140-2-validated cryptography, do the following:

  • Use a new installation of NNMi 10.30
  • By default, NNMi installs a self-signed certificate. recommends that you use CA-signed certificates and not the self-signed certificate. For more information about using the CA-signed certificates, see the Advanced Configuration section in the NNMi Deployment Reference.
  • Follow configuration steps to disable some weaker SNMPv3 ciphers that are not FIPS-certified.
  • Use only NNMi Premium.
  • Install NNMi and NPS on the same system.

Note Despite meeting the requirements listed above, the following components of NNMi and NPS do not use the FIPS 140-2-validated cryptography: remote access to the NPS Console, Performance Troubleshooting window, and Performance tab of the Analysis pane in the NNMi Console

This section provides you with the steps to configure NNMi to use the highest level of FIPS 140-2-validated cryptography.

Prerequisite

Make sure to disable the HTTP mode of communication. See Enable HTTPS-Only Communication for more information.

Configure NNMi

Perform the following tasks to configure NNMi to use FIPS 140-2-validated cryptographic modules:

  1. Task 1: Post-Upgrade Procedure: Encryption of Passwords

    This procedure is relevant only if you upgraded to NNMi10.30 from an older version of NNMi.

    If you did not use the nnmsetcmduserpw.ovpl command before upgrading NNMi to 10.30, skip this procedure.

    Tip Read the reference page of the nnmsetcmduserpw.ovpl command for more information.

    If you used the nnmsetcmduserpw.ovpl command to configure a valid NNMi User Name attribute value and NNMi Password attribute value to seamlessly run command line tools, you must follow these steps:

    1. Log on to the NNMi management server as root or administrator.

    2. Run the nnmsetcmduserpw.ovpl command again to configure all the NNMi credentials that were set before the upgrading NNMi to the version 10.30.

      Tip To find out all the users whose passwords were encrypted by using the nnmsetcmduserpw.ovpl command prior to upgrading NNMi to 10.30, find the nms-users.properties file, and then check the content of the file. Multiple copies of the nms-users.properties file may exist on the server.

  2. Configure Secure SNMPv3 Communication
  3. Select a FIPS-Compliant Algorithm for SNMPv3 Communication

Send Help Center feedback