Prerequisites
If your appliance is managed by a Central Management System, disconnect your appliance from the Central Management System before enabling compliance.
(Optional) If you have a trusted platform module, it is beneficial to enable it as an additional entropy source. This step is optional as our kernel LRNG module is certified for hardware and virtual appliances. The new X600 hardware appliances do not have a TPM.
Enable compliance on managed appliances before enabling compliance on the Central Management System that manages them. For CC-NDcPP certification, the managed appliances must run release 10.0.0. For FIPS 140-3 certification, the managed appliances must run release 9.0.3 or later except for Endpoint Security (HX) , which is release 5.0.3.
Administrator access
Make the Settings: Compliance page visible by running the
compliance options webui enablecommand in configuration mode.
On the Web UI, select the Settings tab.
Select Compliance on the sidebar.
Click Enable CC-NDcPP Compliance.
Click Save changes to continue.
Click Reboot Now.
Check that there are
icons in the CC-NDcPP column on the Settings → Compliance page.
Note
After compliance has been enabled on an appliance, you must use SSH from a server or desktop with supported ciphers. If your SSH client does not support compliant ciphers in its default configuration, you need to specify one or more ciphers on the command line. For example:
aes128-gcm@openssh.com
Otherwise, the connection might fail because the ciphers are incompatible. For example, if by default your client only supports aes128-cbc, you could see an error message like the following:
no matching cipher found: aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr