Staff

Technical Tip: How to enable FIPS-CC mode

Forum|Forum|5 years ago
March 25, 2021
0 replies
47909 views

Description

This article describes how to enable FIPS-CC mode on FortiGate.

Scope

FortiGate, FIPS.

Solution

As a primer, the FortiGate is capable of compliant operation within Federal Information Processing Standards (FIPS) 140-2/140-3 (depending on the FortiOS version) and Common-Criteria (FIPS-CC) specifications. In order to do so, administrators must explicitly enable FIPS-CC mode on the FortiGate (this mode is disabled by default).

Before starting:

For guaranteed compliance, administrators must install a FIPS Certified, Candidate, or CVE-Patched build of FortiOS firmware to the FortiGate. For more information on these designations, refer to the following Community KB article: Technical Tip: Upgrading FortiOS Firmware when FIPS-CC is enabled
- FIPS-specific FortiOS firmware can be downloaded from the Fortinet Support site (look for the 'FIPS-CC-Certified' folder within a given major branch of firmware, such as FortiOS v7.0).
- For an accurate, publicly-accessible list of all Fortinet products (including FortiOS and the specific FortiGate models) that have completed the FIPS 140-2/3 certification process, refer to NIST's Cryptographic Module Validation Program CMVP website.

Note that even for FIPS Certified/Candidate/CVE-Patched firmware, FIPS-CC mode is not enabled by default and must be manually enabled. Administrators can refer to the steps below for guidance on enabling FIPS-CC mode.
FIPS-CC mode can be enabled on all FortiOS firmware versions, such as the mainstream General Availability (GA) firmware. However, only the FIPS Certified/Candidate/CVE-Patched firmware branches are guaranteed and certified to be compliant, so administrators using GA firmware should take caution if GA firmware must be used with FIPS-CC mode enabled.
The recommendation is to use the FIPS-specific firmware discussed above for environments that require FIPS compliance, unless it is not available for a given FortiGate model (not all FortiGate models undergo FIPS certification for a given FortiOS firmware branch)

Note:
FIPS-CC mode can only be activated/configured using a serial console connection to the FortiGate (it is not possible to enable it when connected via the Web GUI or SSH). For guidance on how to connect to the FortiGate's serial console port for management, refer to the following Community KB article: Technical Tip: How to connect to the FortiGate and FortiAP console port.

CLI launched through admin web GUI (note the lack of the status option):

Compared to using a serial console connection:

To enable FIPS-CC mode on the FortiGate, follow the procedure below. However, take care to check the Important Notes section below for potential pitfalls before continuing to enable FIPS-CC mode.

Steps to enable FIPS-CC Mode:

Connect to the FortiGate's serial console port and login to the CLI using the default admin account or another account with the super_admin access profile assigned, then enter the following commands. Note that entropy-token will not be present for FortiGates that have built-in entropy sources (see notes below for more information):

FortiGate # config system fips-cc

FortiGate (fips-cc) # set status enable
FortiGate (fips-cc) # show
config system fips-cc
    set status enable
    set entropy-token enable
end

FortiGate (fips-cc) # end

After entering the commands, a prompt will appear asking to set a new administrator password for the 'admin' account:

FortiGate (fips-cc) # end
Please enter admin administrator password:
New password must confirm to the password policy enforced on this device:
minimum-length=8; must contain upper-case-letter lower-case-letter number non-alphanumeric

Please enter admin administrator password:**********
Please re-enter admin administrator password:**********

The CLI will then display the following warning message:

Warning: most configuration will be lost,
do you want to continue?(y/n)

Type 'y', then hit Enter to confirm. The FortiGate will automatically reboot and run through mandatory FIPS-CC self-tests, after which it will be running in FIPS-CC mode:

The system is going down NOW !!

Please stand by while rebooting the system.
Restarting system.
hw perf events fixed 4 > max(3), clipping!

System is starting...

FIPS-CC mode: Starting self-tests.
Running Configuration/VPN Bypass test... passed
Running AES test... passed
Running SHA1 HMAC test... passed
Running SHA256 HMAC test... passed
Running SHA384/512 HMAC test... passed
Running RSA test... passed
Running ECDSA test... passed
Running Primitive-Z test... passed
Running Firmware integrity test... passed
Running RBG-instantiate test... passed
Running RBG-reseed test... passed
Running RBG-generate test... passed
Self-tests passed
Serial number is FGT61FTKXXXXXXXX

Re-login back into FortiGate using username 'admin' and the password set in Step 2. As part of FIPS-CC requirements, a post-login banner will be displayed that must be accepted by typing 'a':

FortiGate-61F login: admin
Password:
Welcome!


POST WARNING:
This is a private computer system. Unauthorized access or use
is prohibited and subject to prosecution and/or disciplinary
action. Any use of this system constitutes consent to
monitoring at all times and users are not entitled to any
expectation of privacy. If monitoring reveals possible evidence
of violation of criminal statutes, this evidence and any other
related information, including identification information about
the user, may be provided to law enforcement officials.
If monitoring reveals violations of security regulations or
unauthorized use, employees who violate security regulations or
make unauthorized use of this system are subject to appropriate
disciplinary action.


(Press 'a' to accept):

To verify that FIPS mode is enabled, run get system status after logging into the FortiGate and check the FIPS-CC mode entry. Note that on the FIPS Certified firmware for FortiOS v7.4 and later, an '(STS)' suffix will be displayed in the CLI. This is expected behavior, see: Special Technical Support firmware.

FortiGate-61F (STS)# get sys stat
Version: FortiGate-61F v7.4.8,build8964,260128 (FIPS-CC-74-4)
First GA patch build date: 230509
Current Security Level: High
Firmware Signature: certified
Virus-DB: 1.00000(2018-04-09 18:07)
[...]
Virtual domain configuration: disable
FIPS-CC mode: enable
Current HA mode: standalone
Branch point: 2795
Release Version Information: FIPS-CC-74-4
System time: Fri Aug 14 14:52:58 2026
Last reboot reason: warm reboot

Disabling FIPS-CC mode:

In order to disable FIPS-CC mode on a FortiGate, a factory-reset must be execute. This can be performed using the execute factoryreset command in the CLI (it is strongly recommended to only do this when the FortiGate is physically accessible, as this will wipe the configuration). For more information on factory resets on the FortiGate, refer to Technical Tip: How to reset a FortiGate with the default factory settings/without losing management access.

Note that FIPS-CC mode cannot be disabled via configuration change, nor is it ever disabled when upgrading firmware. This is true even when upgrading from GA firmware with FIPS-CC mode enabled to FIPS-Certified/Candidate/CVE-Patched firmware (and vice-versa).

Important Notes before Enabling FIPS-CC:

Ensure that the default admin account is present in the configuration before enabling FIPS-CC, as there have been some reports of the FortiGate being inaccessible after enabling FIPS-CC mode if the default 'admin' account is deleted beforehand (i.e., creating a new super_admin and removing the default 'admin').

The issue has not been reproducible when lab testing several v7.0 Certified and CVE-Patched builds. After enabling FIPS-CC mode and rebooting, FortiGate's expected and tested behavior is to modify/re-add the 'admin' account to the configuration and delete all other existing administrator accounts. Administrators can then log in to the FIPS-enabled FortiGate using 'admin' and the password specified during FIPS-CC setup.

The cautious recommendation is to ensure that the default 'admin' account is present on the FortiGate before enabling FIPS-CC mode. This account already exists by default on new FortiGates and should not be a concern if FIPS mode is being enabled on new/factory-reset FortiGates.

If the issue does occur for some reason, then the recommended remediation is to perform a firmware restore/reinstall using TFTP and a serial console connection. Refer to Technical Tip: Formatting and loading FortiGate firmware image using TFTP for instructions on performing this restore operation.

Note regarding Single Sign-On (SSO) admin accounts:

After enabling FIPS-CC mode, SSO admin accounts with super_admin profiles will be limited to read_only permissions (this is expected behavior).

Note regarding Entropy requirement for FIPS-CC (Updated - March 2026):

In FortiOS v7.0 and earlier (which were certified for FIPS 140-2), the FortiGate required a hardware-based source of entropy for the purposes of random number generation. Hardware models that included CP9-based Content Processors (namely CP9/CP9XLite/CP9Lite) will automatically utilize this onboard hardware as the entropy source, whereas models that did not include this hardware (such as the FortiGate-50E or FortiGate-VMs) would require a USB-based Entropy Token to be plugged in if the entropy-token setting was set to enable.

To temporarily workaround this earlier restriction, administrators can adjust the configuration to not mandate an entropy source, though doing so will mean that the FortiGate is not acting in a FIPS-CC-compliant fashion. Note that this is only necessary and visible for FortiGate models that do not have an onboard source of entropy available:

FortiGate # config system fips-cc
FortiGate (fips-cc) # set entropy-token ?
enable     Enable the entropy token to be present during the boot process.
disable    Disable the entropy token to be present during the boot process.
dynamic    Dynamic detects entropy tokens to be present during the boot process.

However, as of FortiOS v7.2 and v7.4 (which are targeting certification for FIPS 140-3), it is no longer necessary for a hardware-based entropy source to be utilized. Instead, all FortiGate models (including VMs) running this version of FIPS Certified firmware will now only use a FIPS-compliant software-based source of entropy called jitterentropy (AKA JitterEnt), rather than relying on the Content Processor or a USB token for entropy. This also means that there is no need to manually configure the entropy-token setting going forward.

Note regarding High Availability (HA):

FIPS-CC mode can be enabled on units in HA mode (either Active-Active or Active-Passive). However, it needs to be enabled individually on all cluster members (i.e., separately on the Primary and Secondary units).

Note Regarding REST API admin account:

The REST API admin account option is not available for FIPS-CC mode. For more details, see Technical Tip: REST API admin account option is not available for if FIPS-CC mode.

Note regarding Configuration Restoration after enabling FIPS-CC:

When enabling FIPS-CC, the FortiGate warns that 'most configuration will be lost', which implies that some configuration may be retained. This is technically true, as certain configurations (especially those relating to encryption ciphers) will be removed in order to enforce the FIPS-CC requirements.

For example, be aware that after enabling FIPS mode, all existing firewall policies are disabled by default, and also all network interfaces on the FortiGate will be administratively disabled by default (set status down). Be sure to note down the name or ID of the firewall policies that need to be re-enabled.

Fortinet makes no guarantees that any specific aspect of an existing non-FIPS configuration will be retained or function correctly after FIPS-CC is enabled. For example, consider the situation discussed in the following KB article: Technical Tip: Cannot reach Admin HTTPS GUI after enabling FIPS-CC mode on FortiGate with existing configuration.

While it is technically possible to restore a configuration backup from a non-FIPS-enabled FortiGate to a FIPS-enabled FortiGate, there are still no guarantees that all aspects of the configuration will be restored correctly due to potential incompatibilities with FIPS regulations. Take care to separate configuration backups for FIPS-enabled FortiGates from non-FIPS-enabled FortiGates when it comes to potential restore operations.

Overall, the safest recommendation is to assume that the FortiGate configuration will need to be rebuilt when enabling FIPS-CC mode on an existing FortiGate. Instead of enabling FIPS-CC mode on an existing FortiGate, consider taking a spare FortiGate and building a fresh configuration with FIPS-CC enabled, then swapping the spare FortiGate with the existing FortiGate during a maintenance window.

Related articles:

Sign up

Login with SSO

Login to the community

Login with SSO