Prerequisites
If your appliance is managed by a Central Management System, disconnect your appliance from the Central Management System before enabling compliance.
(Optional) If you have a trusted platform module (TPM), it is beneficial to enable it as an additional entropy source. This step is optional as our kernel LRNG module is certified for hardware and virtual appliances. The new X600 hardware appliances do not have a TPM.
Enable compliance on managed appliances before enabling compliance on the Central Management System that manages them. For CC-NDcPP certification, the managed appliances must run release 10.0.0. For FIPS 140-3 certification, the managed appliances must run release 9.0.3 or later except for Endpoint Security (HX) , which is release 5.0.3.
Administrator access
Trellix supports two cipher-level arguments; compliant-security and high-security. On initiation of a connection, the high-security ciphers are offered first, which ensures that if supported, a high-security cipher will be negotiated in practice. If high-security isn’t supported, a compliant-security cipher will be negotiated.
Note
Compliant-security ciphers and high-security ciphers are approved and certified by The National Institute of Standards and Technology (NIST) and National Information Assurance Partnership (NIAP).
See the following sample code for high-security compliance mode and compliant-security compliance mode.
xxxxx-cms9500 (config) # compliance apply standard ? <standard> fips FIPS (Federal Information Processing Standard) cc-ndcpp CC-NDcPP (Common Criteria Network Device Protection Profile) all All supported standards xxxxx-cms9500 (config) # compliance apply standard cc-ndcpp cipher-level ? <cipher-level> compliant-security Configure all security certified standards-compliant ciphers high-security [initial default] Configure only high security certified standards-compliant ciphers (no CBC) previous Reapply with the previously specified cipher security level (high-security if you just upgraded to 10.0) xxxxx-cms9500 (config) # compliance apply standard cc-ndcpp cipher-level
Enable the CLI configuration mode:
hostname > enable hostname # configure terminal
Bring the system into FIPS 140-3 compliance:
hostname (config) # compliance apply standard fips
Save your changes:
hostname (config) # write memory
Reboot the appliance:
hostname (config) # reload
Verify that the appliance is compliant:
hostname (config) # show compliance standard fips
Note
After compliance has been enabled on an appliance, you must use SSH from a server or desktop with supported ciphers. If your SSH client does not support compliant ciphers in its default configuration, you need to specify one or more ciphers on the command line. For example:
aes128-gcm@openssh.com
Otherwise, the connection might fail because the ciphers are incompatible. For example, if by default your client only supports aes128-cbc, you could see an error message like the following:
no matching cipher found: aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr