Simple Mail Transfer Protocol (SMTP) for system administrative email
For compliance, if SMTP is configured to use TLS, use FIPS 140-3 mode TLS 1.0 or better (not SSL) and compliant cipher lists. Certificate verification must be enforced. If SMTP is configured to use plain text only, no constraints are imposed.
Standards
FIPS 140-3, CC-NDcPP
CLI configuration commands
email ssl mode tls
email ssl cert-verify
email ssl min-version tls1
email ssl cipher-list {fips | cc-ndpp | fips-and-cc-ndpp}
CLI show command
show email
Simple Network Management Protocol (SNMP)
If SNMP is disabled, compliance passes. If SNMP is enabled:
SNMPv1 and v2c must be disabled (no community-based access).
SNMPv3 users and trap sinks must not use MD5 hashes or DES privacy.
Standards
FIPS 140-3, CC-NDcPP
CLI configuration commands
If SNMP is disabled:
no snmp-server enable
If SNMP is enabled:
snmp-server enable
no snmp-server enable communities
compliance options snmp-crypto-limit enable
CLI show commands
show snmp
show compliance options
SSL Intercept (Network Security series only)
For compliance, the SSL Intercept proxy feature is disabled on Network Security Series appliances.
Standards
FIPS 140-3, CC-NDcPP
CLI configuration commands
no policymgr interface <port-pair-name> ssl-intercept create
no policymgr interface <port-pair-name> ssl-intercept enable
CLI show commands
show policymgr ssl-intercept
show compliance standard all
SSH 7.4 and SSH 9.8 change implications
Changes between SSH 7.4 and 9.8 have impacted the appliance SSH server services for SCP and the SCP client’s behavior. See the following table for more information.
Command | Trellix 10.x with SSH 7.4 | Trellix 11.x with SSH 9.8 | |
|---|---|---|---|
Appliance SSH server services for SCP and SFTP | Enable the service
| NA | sshd spawns sshd-session for each new ssh instance. |
SFTP client (appliance) | NA | NA | NA |
SFTP server | NA | NA | NA |
SCP client (appliance) | NA | Uses SCP protocol | Uses SFTP protocol internally. For SCP to work, SFTP must be enabled. |
SCP server | NA | NA | NA |
SSH client and server keys
For compliance, the SSH client and SSH server must use only keys of 2,048 bits or greater, and only RSAv2 keys are allowed.
Important
RSA1 and DSA2 keys are deleted from the configuration. The Server Known Host Keys compliance is reasserted.
Standards
FIPS 140-3, CC-NDcPP
CLI configuration commands
cmc auth ssh host-key strict
cmc auth ssh host-key global-only
cmc auth ssh min-key-length 2048
ssh server min-key-length 2048
ssh client min-key-length 2048
CLI show commands
show cmc auth ssh
show ssh server
show ssh client
SSH CM series management client protocol
For compliance, CM Series SSH client communications must use SSHv2 with a FIPS-compliant list of ciphers, MACs, and key exchange algorithms.
Standards
FIPS 140-3, CC-NDcPP
CLI configuration commands
cmc auth ssh min-version 2
cmc auth ssh cipher-list {fips | fips-high-security | cc-ndpp | cc-ndpp-high-security | fips-and-cc-ndpp | fips-and-cc-ndpp-high-security}
CLI show command
show cmc auth ssh
SSH server known host keys
For compliance, CM Series SSH client communications require manually configured known host entries. For compliance:
Do not automatically accept any host keys as known host entries.
Do not use per-user known host entries.
Standards
FIPS 140-3, CC-NDcPP
CLI configuration commands
cmc auth ssh host-key strict
cmc auth ssh host-key global-only
CLI show command
show cmc auth ssh
SSH server protocol
For compliance, the SSH server must use SSHv2 with a FIPS-compliant list of ciphers, MACs, and key exchange algorithms.
Standards
FIPS 140-3, CC-NDcPP
CLI configuration commands
ssh server min-version 2
ssh server cipher-list {fips | fips-high-security | cc-ndpp | cc-ndpp-high-security | fips-and-cc-ndpp | fips-and-cc-ndpp-high-security}
CLI show command
show ssh server
SSH user client protocol
For compliance, SSH client communications from managed appliances must use SSHv2 with a FIPS-compliant list of ciphers, MACs, and key exchange algorithms.
Standards
FIPS 140-3, CC-NDcPP
CLI configuration commands
ssh client global min-version 2
ssh client global cipher-list {fips | fips-high-security | cc-ndpp | cc-ndpp-high-security | fips-and-cc-ndpp | fips-and-cc-ndpp-high-security}
CLI show command
show ssh client
SSL certificates
For compliance, SSL (TLS) certificates that belong to the appliance must have a key longer than 2,048 bits and use SHA-256, SHA-384, or SHA-512 for their public signature (hash) algorithm.
Standards
FIPS 140-3, CC-NDcPP
CLI configuration commands
crypto certificate min-key-size 2048
crypto certificate secure-hashes-only