topic Re: ONTAP 9.3P15: Enabling FIPS Mode in ONTAP Discussions

ONTAP 9.3P15: Enabling FIPS Mode

duanebachi — Thu, 16 Jan 2020 12:41:01 GMT

Has anyone enabled FIPS mode? We have several FAS 8060 nodes in a cluster with ONTAP 9.3P15 and we are looking to enable FIPS mode.

I am looking at this document:

https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cm-nmg%2FGUID-A799B86D-B1B5-4AB6-B610-D0651D7C1548.html

So if I run and reboot:

security config modify -interface SSL -is-fips-enabled true

Does the security config looks like this?

FIPS: on
SSL protocol = {TLSv1.2}
SSL ciphers = {ALL:!LOW:!aNULL:!EXP:!eNULL:!RC4}

Any issue anyone experience?

What if we need TLS v1.1?

Re: ONTAP 9.3P15: Enabling FIPS Mode

AlexDawson — Fri, 17 Jan 2020 02:42:30 GMT

Hi there!

This page shows the output of "security config show" when FIPS is enabled - https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cm-cmpr-950%2Fsecurity__config__show.html

Which includes the line you suspected it would show, as well as showing tls1.1 is enabled.

ALL:!LOW:!aNULL:!EXP:!eNULL:!RC4

Hope this helps!

Re: ONTAP 9.3P15: Enabling FIPS Mode

duanebachi — Fri, 17 Jan 2020 12:46:35 GMT

Hi Alex,

Thanks for your reply. That page you showed me is for 9.5 and also that is the default when FIPS is disabled. One of the things I need to know is that if I enable FIPS, does it only allow TLS1.2? Will it let me add TLS 1.1 or would that invalidate FIPS?

Re: ONTAP 9.3P15: Enabling FIPS Mode

AlexDawson — Wed, 22 Jan 2020 02:56:16 GMT

Hi there! The page for 9.3 is the same - https://docs.netapp.com/ontap-9/index.jsp?topic=%2Fcom.netapp.doc.dot-cm-cmpr-930%2Fsecurity__config__show.html - which includes showing TLS 1.1 is enabled with FIPS mode on, so you won't need to change anything.

Re: ONTAP 9.3P15: Enabling FIPS Mode

liu — Sun, 27 Apr 2025 09:05:54 GMT

This document states that for ONTAP versions prior to 9.11.1, if the FIPS 140-2 compliance mode is enabled, both TLSv1 and SSLv3 will be disabled, while only TLSv1.1 and TLSv1.2 will remain enabled. However, TLSv1.1 has been regarded as an insecure protocol

FIPS mode and TLS and SSL management in ONTAP

How to harden ONTAP 9 TLS configuration - NetApp Knowledge Base