REST API administrator account availability in FIPS-CC mode

Description

Lists of FortiOS firmware versions that do and do not support REST API administrator accounts when FIPS-CC mode is enabled.

Scope

FortiOS version 6.0 or above.

Solution

When FIPS-CC mode is enabled, the following FortiOS versions disable REST API for administrative users:

• FortiOS version 6.0 (GA and FIPS-CC).

• FortiOS version 6.2 (GA and FIPS-CC).

• FortiOS version 6.4 (GA and FIPS-CC).

• FortiOS version 7.0 (GA and FIPS-CC Certified).

• FortiOS version 7.2 (GA).

• FortiOS version 7.4.0 GA.

The following FortiOS versions support configuring and using REST API users for administering the firewall when FIPS-CC mode is enabled:

• FortiOS version 7.0 (FIPS-CC-70-9 build 8800 and above).

• FortiOS version 7.2 (FIPS-CC).

• FortiOS version 7.4.1 and above (GA and FIPS-CC).

• FortiOS version 7.6 and above.
  

This difference is by design and does not affect FIPS compliance.

All FortiOS versions since the introduction of REST API users support them when FIPS-CC mode is disabled.

Note: For more information on FIPS-CC branch versions and numbers, see Technical Tip: How to Verify if a FortiOS FIPS-CC Image is Certified or Patched.

To verify whether FIPS mode is enabled or not, use the command: get system status | grep -i fips-cc.

FortiGate-400E # get system status | grep -i fips-cc
Version: FortiGate-400E v7.0.12,build8800,230619 (FIPS-CC-70-9)
FIPS-CC mode: enable
Release Version Information: FIPS-CC-70-9

The output above shows 'FIPS-CC mode: enable', which indicates the device is operating in FIPS-CC mode.

Related documents:

REST API administrator

Technical Tip: How to enable FIPS-CC mode