The Cisco ACI must use FIPS 140-2/140-3 approved algorithms for authentication to a cryptographic module.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-271966 | CACI-ND-000051 | SV-271966r1114341_rule | High |
| Description |
| Unapproved mechanisms used for authentication to the cryptographic module are not validated and therefore, cannot be relied on to provide confidentiality or integrity, and DOD data may be compromised. Cisco ACIs using encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2/140-3 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets DOD requirements. However, authentication algorithms must configure security processes to use only FIPS-approved and NIST-recommended authentication algorithms. Satisfies: SRG-APP-000179-NDM-000265, SRG-APP-000411-NDM-000330, SRG-APP-000412-NDM-000331 |
| STIG | Date |
| Cisco ACI NDM Security Technical Implementation Guide | 2025-06-13 |
Details
| Check Text (C-76016r1063293_chk) |
| 1. Navigate to System >> System Settings. 2. Click "Fabric Security". 3. Click the "Policy" tab. 4. Verify FIPS Mode is set to "Enable". If FIPS mode is not set to "Enable", this is a finding. |
| Fix Text (F-75923r1064044_fix) |
| When FIPS is enabled, it is applied across the Cisco Application Policy Infrastructure Controller (APIC). 1. On the menu bar, select System >> System Settings. 2. In the Navigation pane, select "Fabric Security". 3. In the Work pane, in the Properties area, select the desired FIPS mode. 4. Reboot to complete the configuration. |