Technical Tip: How to enable FIPS-CC mode

Disabling FIPS-CC mode:

In order to disable FIPS-CC mode on a FortiGate, a factory-reset must be executed. This can be performed using the execute factoryreset command in the CLI (it is strongly recommended to only do this when the FortiGate is physically accessible, as this will wipe the configuration). For more information on factory resets on the FortiGate, refer to Technical Tip: How to reset a FortiGate with the default factory settings/without losing management access.

Important Notes before Enabling FIPS-CC:

Ensure that the default admin account is present in the configuration before enabling FIPS-CC:

There have been some reports that the FortiGate may be inaccessible after enabling FIPS-CC mode if the default 'admin' account is deleted beforehand (i.e., creating a new super_admin and removing the default 'admin').

The issue has not been reproducible when lab testing several v7.0 Certified and CVE-Patched builds. After enabling FIPS-CC mode and rebooting, FortiGate's expected and tested behavior is to modify/re-add the 'admin' account to the configuration and delete all other existing administrator accounts. Administrators can then log in to the FIPS-enabled FortiGate using 'admin' and the password they specified during FIPS-CC setup.

The cautious recommendation is to ensure that the default 'admin' account is present on the FortiGate before enabling FIPS-CC mode.

This account will exist by default on new FortiGates and should not be a concern if FIPS mode is being enabled on new/factory-reset FortiGates.

If the issue does occur for some reason, then the recommended remediation is to perform a firmware restore/reinstall using TFTP and a serial console connection. Refer to Technical Tip: Formatting and loading FortiGate firmware image using TFTP for instructions on performing this restore operation.

Note regarding Single Sign-On (SSO) admin accounts:

After enabling FIPS-CC mode, SSO admin accounts with super_admin profiles will only have read_only permissions even if they are configured with a super_admin profile.

Note regarding Entropy requirement for FIPS-CC (Updated - March 2026):

In FortiOS v7.0 and earlier (which were certified for FIPS 140-2), the FortiGate required a hardware-based source of entropy for the purposes of random number generation. Hardware models that included CP9-based Content Processors (namely CP9/CP9XLite/CP9Lite) will automatically utilize this onboard hardware as the entropy source, whereas models that did not include this hardware (such as the FortiGate-50E or FortiGate-VMs) would require a USB-based Entropy Token to be plugged in if the entropy-token setting was set to enable.

To temporarily workaround this earlier restriction, administrators can adjust the configuration to not mandate an entropy source, though doing so will mean that the FortiGate is not acting in a FIPS-CC-compliant fashion. Note that this is only necessary and visible for FortiGate models that do not have an onboard source of entropy available:

FortiGate # config system fips-cc
FortiGate (fips-cc) # set entropy-token ?
enable     <--- Enable the entropy token to be present during the boot process.
disable    <--- Disable the entropy token to be present during the boot process.
dynamic    <--- Dynamic detects entropy tokens to be present during the boot process.

However, as of FortiOS v7.2 and v7.4 (which are targeting certification for FIPS 140-3), it is no longer necessary for a hardware-based entropy source to be utilized. Instead, all FortiGate models (including VMs) running this version of FIPS Certified firmware will now only use a FIPS-compliant software-based source of entropy called jitterentropy (AKA JitterEnt), rather than relying on the Content Processor or a USB token for entropy. This also means that there is no need to manually configure the entropy-token setting going forward.

Note regarding High Availability (HA): 

FIPS-CC mode can be enabled on units in HA mode (either Active-Active or Active-Passive). However, it needs to be enabled individually on all cluster members (i.e., separately on the Primary and Secondary units).

Note Regarding REST API admin account: The REST API admin account option is not available for FIPS-CC mode. For more details, see Technical Tip: REST API admin account option is not available for if FIPS-CC mode.

Note regarding Configuration Restoration after enabling FIPS-CC:

When enabling FIPS-CC, the FortiGate warns that 'most configuration will be lost', which implies that some configuration may be retained. This is technically true, as certain configurations (especially those relating to encryption ciphers) will be removed in order to enforce the FIPS-CC requirements.

For example, be aware that after enabling FIPS mode, all firewall policies are disabled by default, and also all network interfaces on the FortiGate will be administratively disabled by default (set status down). Be sure to note down the name or ID of the firewall policies that need to be re-enabled

With that being said, Fortinet makes no guarantees that any specific aspect of an existing non-FIPS configuration will be retained or function correctly after FIPS-CC is enabled. For example, consider the situation discussed in the following KB article: Technical Tip: Cannot reach Admin HTTPS GUI after enabling FIPS-CC mode on FortiGate with existing configuration.

Additionally, while it is technically possible to restore a configuration backup from a non-FIPS-enabled FortiGate to a FIPS-enabled FortiGate, there are still no guarantees that all aspects of the configuration will be restored correctly due to potential incompatibilities with FIPS regulations. Take care to separate configuration backups for FIPS-enabled FortiGates from non-FIPS-enabled FortiGates when it comes to potential restore operations.

All in all, the safest recommendation is to assume that the FortiGate configuration will need to be rebuilt when enabling FIPS-CC mode on an existing FortiGate. Instead of enabling FIPS-CC mode on an existing FortiGate, consider taking a spare FortiGate and building a fresh configuration with FIPS-CC enabled, then swapping the spare FortiGate with the existing FortiGate during a maintenance window.