Enable FIPS mode on the SMC Appliance

You must enable FIPS mode and enable 256-bit encryption as the security strength when you install the SMC Appliance.

Before you begin

Prepare the appliance for installation:
  • Determine the appliance networking information:
    • IPv4 network address and network mask
    • (Optional) Default gateway address
    • (Optional) DNS server addresses
  • Install the SMC Appliance as a virtual appliance in ESXi. Follow the guidelines in the Installing SMC Appliance software on a virtualization platform appendix in the Forcepoint Network Security Platform Installation Guide.
  • Access the appliance using the virtual machine console in the VMware Host Client.

The password is not shown while logging on to the local console. No configuration or preparatory steps are required.

When 256-bit encryption is enabled, the SMC TLS Client and Server settings are automatically configured to use:
  • TLS 1.2 as the protocol
  • ECDSA P-521 with SHA-512 in digital signatures in connections between the SMC and the Security Engines.
    Note: ECDSA P-384 with SHA-384 when using ECDSA P-384 certificates issued by an external CA.
  • P-521 NIST curve in TLS key establishment in connections between the SMC and the Security Engines.
    Note: P-384 NIST curves when using ECDSA P-384 certificates issued by an external CA.
  • P-256, P-384, and P-521 NIST curves, in TLS key establishment, with SHA-256, SHA-384, or SHA-512 in digital signatures, in Web Access and in connections to external servers.

The Management Server and Log Server only accepts the TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 cipher suites when acting as TLS server for connections from Security Engines.

Use the main network interface for management for the connection to the Security Engine, and for the connection to the SMC Client and external syslog server.

Steps

  1. After SMC Appliance reboots following the installation, please proceed by accepting the End User License Agreement (EULA).
  2. Select Begin, then press Enter.
  3. Select the keyboard layout for accessing the SMC Appliance on the command line.
  4. Enter the administrator account name and password.
    Note: The administrator account and password are used for command line access to the SMC Appliance and for access to the SMC Client. The administrator account is created with unrestricted permissions (superuser).
    1. Enter the account name.
      This field is case sensitive and limited to eight characters.
    2. Enter the password.
      The password is case sensitive. The password must be at least ten characters long and contain at least one number.
    3. Enter the password again.
  5. (Optional) Configure a bootloader password.
    If you configure a bootloader password, you must enter the bootloader password to edit the options that appear in the bootloader menu of the SMC Appliance.
    1. Press the space bar to configure a bootloader password.
    2. Enter the password.
    3. Enter the password again.
  6. Make your security selections.
    1. Select FIPS mode.
    2. Select 256-bit encryption as the security strength.
    3. (Optional) Select Use External Certificate Authority.
      Note:
      • When you install the SMC, you can use certificates issued by an external CA for internal TLS communication between system components.
      • You must complete the following actions after installation before you can start using the SMC:
        • Import the external CA certificate.
        • Generate and export certificate requests.
        • Sign the certificates using the external CA.
        • Import the signed certificates.
        Note: Only the ECDSA public key algorithm is supported.
  7. To enable network interface configuration, select Disabled, then press Enter.
  8. Complete the network interface configuration for the primary network interface for management.
    1. Select Enable interface.
    2. Select Primary.
    3. Complete the network configuration fields for the interface.
  9. (Optional) Complete the network interface configuration for the secondary network interface for management.
    1. Select Enable interface.
    2. Select Secondary.
    3. Complete the network configuration fields for the interface.
  10. Enter a host name for the Management Server.
  11. (Optional) Enter one or more IPv4 or IPv6 addresses in the DNS server fields.
    Note: When using an external CA, it is necessary to configure at least one DNS server.
  12. (Optional) If you do not want to use NTP, disable it in the NTP settings.
    Note: We recommend that you configure an NTP server when using an external CA so that the time settings for the SMC are accurate when checking validity times for certificates, CRLs, and OSCP server responses.
  13. Select the time zone.
  14. Set the date and time.
    You are prompted to review the configuration.
  15. Select Confirm, then press Enter.

Result

When the installation is complete, select one of the following options:
  • Reboot
  • Shutdown.