RADIUS authentication protocol
For compliance, RADIUS authentication must be disabled.
Standards
FIPS 140-3, CC-NDcPP
CLI configuration command
aaa authentication login default {ldap | local}
CLI show command
show aaa
Random number generator
For compliance, the TPM hardware-based random number generator must be enabled for good entropy.
Standards
FIPS 140-3, CC-NDcPP
CLI configuration commands
tpm enable
tpm rng enable
CLI show command
show tpm
Remote syslog certificate verification
For strict compliance with the Common Criteria (CC-NDcPP) standard, syslog server certification verification for remote logging fails if the certificate is configured with an IP address in the Common Name (CN) field, a change from previous behavior. To configure a remote syslog server by its IP address, the IP address must be in the Subject Alternative Name (subjectAltName) field. The following commands support configuration of explicit X.509 rules to match the subjectAltName field of a certificate by hostname, IP address, or email address.
CLI configuration commands
[no] logging <hostname-or-IP-address> tls certificate match-x509-cert-san-or cn-hostname <hostname-to-match>
[no] <hostname-or-IP-address> tls certificate match-x509-cert-san-ipv4-or-ipv6 <IP-address-to-match>
[no] logging <hostname-or-IP-address> tls certificate match-x509-cert-san-email <email-addr>
CLI show command
show logging
Remote syslog encryption
For compliance, all syslog communications (both received from other hosts and sent to other hosts) must be over FIPS 140-3 mode, TLS 1.0 or better and have compliant cipher lists and certificate verification.
CLI configuration commands
no logging receive protocol udp port <port>
no logging receive protocol tcp port <port>
logging receive ssl cipher-list {fips | fips-high-security | cc-ndpp | cc-ndpp-high-security | fips-and-cc-ndpp | fips-and-cc-ndpp-high-security}
logging receive ssl min-version tls1
no logging <host> protocol udp port <port>
no logging <host> protocol tcp port <port>
logging remote ssl min-version tls1
logging remote ssl cipher-list fips-and-cc-ndpp
logging remote ssl cert-verify
CLI show command
show logging
Restricted commands license
For compliance, the RESTRICTED_CMDS licenses must be disabled.
Standards
FIPS 140-3, CC-NDcPP
CLI configuration command
no compliance options restricted-license enable
CLI show command
show compliance options