Prerequisites to FIPS-CC Mode

• All variants of Prisma SD-WAN Controllers (On-Premises, Commercial, FedRAMP) adhere to the X.509 certificate specifications.
• Certificate revocation is checked based on the following conditions:
  • OCSP-based (Online Certificate Status Protocol) checks are enabled by default in FIPS-CC mode. You cannot disable the checks.
  • TLS and standard IPSec VPN connections are dropped if the revocation check fails.
  • If no OCSP parameters are included in the certificate, OCSP revocation checks are ignored. For example, in a syslog profile with TLS, if the certificate does not contain the OCSP attributes, the ION can't check the revocation status and hence will allow the TLS connection to be established.
  • If OCSP attributes are included in the certificate and if the certificate is revoked, connections will be dropped mandatorily.
  • If an ION device is unable to reach the OCSP responder, the IPsec and TLS connections fail.
  • The OCSP responder should be reachable from the source interface used for the syslog server or the standard VPN interface. OCSP certificate revocation is done only for syslog over TLS and standard IPSec (VPN ) tunnel using certificate-based authentication.
• NTP authentication is based on the following conditions:
  • NTP Authentication is only enabled in the FIPS-CC mode; it is disabled by default.
  • An ION device supports only SHA256 for NTP authentication; MD5 is not supported.
  • During ION device upgrade and FIPS mode change scenarios, you must explicitly enable NTP authentication after the upgrade and/or completion of the FIPS-CC mode change to comply with CC specifications.
  • To downgrade an ION device to pre-6.5.1, you must explicitly disable NTP authentication.
• Standard IPSec VPN symmetric algorithm key strength requirements are adhered to when upgrading an ION device to 6.5.x in FIPS-CC mode.
  • IKEv2 is supported only in FIPS-CC mode. You need to update the standard IPSec VPN profile if IKEv1 is configured before upgrading to 6.5.1 or changing the mode to release 6.5.1.
  • Only approved encryption and hashing algorithms are allowed for IKE and standard IPSec VPN proposals.
  • Approved DH groups and X.509 validations are supported.
  • The IKE encryption key size should be greater than the IPSec encryption key size when negotiating between IPSec endpoints (ION device and third-party peer).
  • If unsupported encryptions are used in configuring Syslog TLS, connections will fail.