Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

NetScaler FIPS FAQ

September 13, 2024
Contributed by: 
C

General Overview

What is the Federal Information Processing Standard (FIPS)?

FIPS is a standard and guideline for federal computer systems that are developed by the National Institute of Standards and Technology (NIST) in accordance with the Federal Information Security Management Act (FISMA) and approved by the Secretary of Commerce. These standards and guidelines are developed when there are no acceptable industry standards or solutions for a particular government requirement. Although FIPS is developed for use by the federal government, many organizations and companies voluntarily use these standards.

The Federal Information Processing Standard (140-2, 140-3) specifies the security requirements that will be satisfied by a cryptographic module, providing four increasing, qualitative levels intended to cover a wide range of potential applications and environments. The areas covered, related to the secure design and implementation of a cryptographic module, include specification, ports and interfaces, roles, services, and authentication, finite state model, physical security, operational environment, cryptographic key management, electromagnetic interference/electromagnetic compatibility (EMI/EMC), self-tests, design assurance, and mitigation of other attacks.

For more information, see https://www.nist.gov/standardsgov/compliance-faqs-federal-information-processing-standards-fips.

What is the difference between compliant and validated?

A FIPS validated or certified solution is one that has undergone a thorough testing process conducted by one of a handful of independent laboratories to ensure that all pieces of the product meet FIPS requirements.

A FIPS compliant solution is one where likely only a portion of the product has been fully verified. In the case of the first two generations of NetScaler FIPS appliances, Citrix leveraged a Hardware Security Module that is fully validated as a way to provide the additional security requirements to meet FIPS level compliance. In the current generation of appliances, NetScaler has worked on getting the specific components validated directly, resulting in an ADC that is now fully validated to meet FIPS requirements.

Form factor and series options

What are the current FIPS options for NetScaler?

Currently, NetScaler appliances are available in validated and compliant versions against FIPS 140-2. FIPS 140-3 validation is currently “Module In Process” (MIP) for 13.1 FIPS-based appliances. For more information on this process available here (search the page for NetScaler): https://csrc.nist.gov/projects/cryptographic-module-validation-program/modules-in-process/modules-in-process-list.

The following tables list the available options for FIPS 140-2 appliances:

FIPS category Platform Supported OS CPU Memory Interfaces/Hypervisor
140-2/Level-2 MPX 8900 FIPS
12.1-FIPS (Cert #4043) 13.1-FIPS
8-core
32 GB
4x10G SFP+; 6x10/100/100
140-3/Level-2 (8x10G; 4x40G)
140-2/Level-2 MPX 15000-50G FIPS
12.1-FIPS (Cert #4043) 13.1-FIPS (MIP)
8-core
128 GB
4x 50G E QSFP 28 8x 10G SFP+
140-3/Level-2 (16x10G, 2*40G)
140-3/Level-2
MPX 9100 FIPS
13.1-FIPS (MIP)/14.1-FIPS
10-Core
64 GB
8 x 25GE SFP28
(8x10G, 4x40G)
140-2/Level-1 VPX-FIPS 12.-FIPS (Cert. #4098) n-Core From 1 GB VMware vSphere, Microsoft Hyper-V, Citrix XenServer, ASW, GCP, Azure, KVM, Oracle Virtual Box, OpenStack, Nutanix AHV

Notes:

12.1-FIPS is 140-2 - Validated on MPX 8900 FIPS, MPX 15000-50G FIPS

*13.1-FIPS is 140-3 - Module In Process

**MPX FIPS 9100 will only support from 13.1-FIPS and future 14.1-FIPS

MPX 14000-FIPS is not validated but a FIPS compliant platform.

See the NetScaler ADC Product Matrix for the updated list of platforms.

Which NetScaler appliances are FIPS validated?

The NetScaler MPX 8900 FIPS and MPX 15000-50G FIPS validated appliances (Cert #4043) have been tested by a third-party laboratory for the security requirements of FIPS 140-2 Level 2.

The NetScaler VPX FIPS appliance is validated for FIPS 140-2 Level 1 (Cert. #3732). The module is available as a software package that includes both the application software and the operating system. After purchasing the NetScaler VPX FIPS license, get the latest NetScaler VPX FIPS 12.1 image from the Citrix website https://www.citrix.com/downloads/ and deploy it to a host with appropriate hardware.

More information about the FIPS 140-2 standard and validation program is available on the National Institute of Standards and Technology (NIST) and the Canadian Center for Cyber Security (CCCS) Cryptographic Module Validation Program (CMVP) website at https://csrc.nist.gov/projects/cryptographic-module-validation-program.

Why did NetScaler develop its own cryptographic modules for FIPS validation?

NetScaler decided to discontinue using third-party Hardware Security Modules in the FIPS ADC appliances to have deeper control over the overall architecture of the appliances. The benefits of this change come in the following areas:

  • Instead of only being able to offer FIPS ADC appliances in hardware form, the purpose-built firmware is now also packaged and licensed as a virtual appliance and this offers customers more flexibility in how they deploy ADCs.

  • There is no longer a dependency on a third-party company to provide the add-on hardware or the firmware that it runs. This ensures better availability of components.

  • By architecting and developing all of the software in-house, NetScaler is able to overcome performance limitations that existed due to the communication with the add-on hardware components. The result for customers is being able to deploy FIPS appliances that perform better.

  • The most significant benefit may be that NetScaler customers are now able to deploy FIPS Validated appliances as opposed to FIPS compliant appliances.

Is FIPS 140-3 level 2 more secure than FIPS 140-2 Level 3?

Any level 3 device provides stronger physical security. Level 2 satisfies the tamper evident physical security. The primary distinction between them is the physical security requirement.

Is NetScaler trading off security over performance by having MPX 9100 at Level 2?

No, we are not trading off security over performance. Providing an additional layer of physical security is not the only way to protect sensitive data. MPX 9100 FIPS leverages the latest version of 140-3 standards and processor technology with robust cryptographic capabilities. MPX 9100 FIPS provides a stronger alternative to HSM. In fact, the software-based key management optimizes the performance without compromising the security needs.

FIPS Encryption/Ciphers

Which ciphers are supported on NetScaler MPX 8900/15000-50G FIPS and VPX FIPS?

For information on supported ciphers, see https://docs.netscaler.com/en-us/citrix-adc/downloads/cipher-support-on-netscaler-mpx-vpx-fips-certified-appliance.pdf

What key sizes are supported in the VPX FIPS and MPX 8900/15000-50G FIPS series?

Customers can use key sizes of 2048 bits, 3072 bits, and 4096 bits, although only key sizes of 2048 bits and 3072 bits can be generated directly on the FIPS appliances with ssl-keygen.

What happens if I try to add non-compliant ciphers to my virtual servers that are using a certificate to enable FIPS encryption?

An error message appears because non-compliant ciphers are not supported on NetScaler.

Features and Functions

Does NetScaler FIPS include all the standard NetScaler functionality?

Yes. However, the following limitations apply:

  • For NetScaler MPX FIPS, TACACS authentication is not supported on the MPX FIPS validated appliances. For more information, see Limitation.

  • For NetScaler VPX FIPS, TACACS authentication is not supported on the VPX FIPS validated appliance. For more information, see VPX FIPS Limitations.

Upgrading NetScaler firmware

One of the most important aspects of running a NetScaler is ensuring that you keep the firmware up-to-date with a compatible version. The information in this section is intended to help you understand which firmware is compatible with the particular NetScaler FIPS appliance that you have so that you can select an appropriate firmware when upgrades are necessary.

How do I know which firmware is compatible with my NetScaler?

NetScaler appliances run either a general firmware or FIPS firmware depending on the specific model. The naming convention for firmware indicates whether it is a FIPS firmware by including FIPS in the name. Also, the naming convention always provides information on the version and the build numbers as well. The specific model of NetScaler determines which firmware type is used. Here are some naming examples:

  • Example of naming of a general firmware, version 13.1, build 49.13:
    • NetScaler Release (Maintenance Phase) 13.1 Build 49.13
    • Citrix ADC Release (Maintenance Phase) 13.1 Build 49.13
  • Example of naming of a FIPS firmware, version 13.1, build 37.159
    • NetScaler FIPS Release 13.1 Build 37.159
    • Citrix ADC FIPS Release 13.1 Build 37.159

NetScaler appliances can be upgraded to newer builds within a specific version. For example, upgrading from an older build of 12.1 FIPS to a newer build of 12.1 FIPS is supported. While it is also possible to move from a later build to an earlier build within a major version, or even move from a later version to an earlier version of compatible firmware, you must understand the risks and implications of doing so as certain features in newer versions might not be available in older versions.

The following table can be used as a guide in determining which major firmware versions are compatible based on the NetScaler model.

NetScaler Models Firmware Type Compatible Firmware
VPX FIPS, MPX8900 FIPS, MPX15000-50G FIPS FIPS 12.1 FIPS or 13.1 FIPS
MPX9100 FIPS FIPS 13.1 FIPS

For more information, see MPX Hardware-Software Compatibility Matrix and SDX Hardware-Software Compatibility Matrix.

For more information about SDX Single Bundle Upgrade (including minimum 12.1 version requirements to upgrade to 13.0 and later), see SDX Single bundle upgrade.

Contact Citrix Support for help with upgrading and unsupported software version.

Can I upgrade to a FIPS validated version firmware from a non-FIPS version of firmware?

No. FIPS validated firmware is a separate image. Software version upgrade from non-FIPS version to FIPS version is not supported. Also, the FIPS software version cannot be downgraded or upgraded to a non-FIPS software version. There is no option to “convert” between a FIPS and non-FIPS validated appliance through license or firmware changes. Any appliance that was not purchased as FIPS validated remains non-validated and must not be operated in a manner compliant with FIPS.

How do I upgrade firmware on my FIPS validated appliances?

The upgrade process is identical to that of the non-FIPS firmware appliances except that the FIPS-validated firmware is required (standard firmware cannot be used).

Can VPX FIPS be installed on NetScaler SDX or NetScaler SDX FIPS appliances?

No. VPX FIPS image is not supported on a NetScaler SDX or NetScaler SDX FIPS appliance.

Can we upgrade or downgrade VPX to VPX FIPS or vice versa?

No. VPX FIPS is a separate image and cannot be upgraded or downgraded to the VPX firmware. Also, we cannot upgrade or downgrade VPX to VPX FIPS firmware.

Firmware information and differences

Can the FIPS validated build be installed on the MPX series other than MPX 8900 series FIPS and MPX 15000-50G series FIPS?

No. FIPS validated build is only qualified to run on MPX 8900 series FIPS and MPX 15000-50G series FIPS appliances.

Can I deploy NetScaler FIPS appliances in a high-availability deployment?

Yes. For FIPS validated MPX and VPX appliances, the HA configuration steps are the same as for non-FIPS appliances.

Before getting started with HA configuration, for MPX 8900 FIPS series and MPX 15000-50G FIPS series, see Configuration and for VPX FIPS, see VPX FIPS Configuration.

For the MPX/SDX 14000 series FIPS, see Configure FIPS on appliances in an HA setup.

Can I deploy a NetScaler FIPS Cluster

Yes. Configuration steps for NetScaler VPX FIPS, NetScaler MPX 8900 FIPS, and MPX 15000-50G FIPS are the same as for non-FIPS appliances. For more information, see https://docs.netscaler.com/en-us/citrix-adc/12-1/clustering.html.

Will the NetScaler MPX 14000 FIPS commands work on NetScaler MPX 8900/15000-50G FIPS appliances?

No. The NetScaler MPX 14000 FIPS-specific commands will not work on the latest NetScaler MPX 8900/15000-50G appliances. For more information, see https://docs.netscaler.com/en-us/citrix-adc/12-1/ssl/citrix-adc-mpx-fips-certified-appliance.html.

Do VPX FIPS and MPX 8900/15000-50G series FIPS support Admin Partitions? Are there any differences from non-FIPS appliances?

Yes. The FIPS series support Admin Partitions.

Which NetScaler appliances require specific firmware, and why?

The NetScaler VPX FIPS and NetScaler MPX 8900/9100/15000-50G FIPS appliances use FIPS-validated firmware. These series meet specific design and build specifications to support the FIPS-validated firmware to achieve FIPS validated status. In the case of the MPX FIPS appliances listed here, they must run the FIPS-validated firmware to achieve the FIPS-validated status as they do not use a Hardware Security Module as previous appliances had used.

All other appliances, including the MPX/SDX 14000 FIPS, use standard firmware.

Pooled Licensing

Is Pooled licensing supported on NetScaler MPX 8900/9100/15000-50G and NetScaler VPX FIPS appliances?

Yes. For NetScaler MPX FIPS, following the purchase of the Zero-capacity FIPS hardware model, the appliance bandwidth capacity can be configured.

For NetScaler VPX FIPS, the appliance needs a VPX FIPS instance license to be uploaded to NetScaler Console after which the instance capacity can be configured.

Can a common license pool be used for NetScaler FIPS and non-FIPS appliances?

Yes. A common bandwidth pool can be shared between FIPS and non-FIPS appliances.

For NetScaler MPX FIPS, a Zero-capacity FIPS hardware appliance is required.

For NetScaler VPX FIPS, the appliance needs a VPX FIPS instance license to be uploaded to NetScaler Console after which the instance capacity can be configured.

Contact your NetScaler Sales for detailed information around this topic.

Can an existing NetScaler FIPS appliance be transitioned from perpetual to pooled license?

Yes. NetScaler FIPS appliances can be migrated from perpetual to pooled licensing. See the following topics for details:

VPX FIPS

Which hypervisors are supported for NetScaler VPX FIPS?

NetScaler VPX FIPS is a software appliance with an overall security level of FIPS 140-2 Level 1. It runs as a virtual appliance, and was tested and found compliant on the following platforms with Intel CPU supporting RDRAND and RDSEED instruction sets:

Hypervisor: VMware ESXi, KVM, Microsoft Hyper-V, Citrix Hypervisor, Microsoft Azure, AWS, and GCP.

What are the prerequisites to run a NetScaler VPX FIPS appliance?

See the Prerequisites.

How is NetScaler VPX FIPS packaged?

The FIPS module is available as a software package that includes both the application software and the operating system. After purchasing the NetScaler VPX FIPS license, get the latest NetScaler VPX FIPS image from the Citrix website https://download.citrix.com.

Where can I find NetScaler FIPS documentation?

The following documents contain information about the supported NetScaler FIPS appliances:

FIPS Compliant Series

FIPS Validated Series

SDX FIPS (14000 family of appliances)

On a NetScaler SDX FIPS appliance, are all instances automatically FIPS compliant?

No. SDX 14000 FIPS is not fully FIPS complaint. Only the SVM is FIPS complaint. Running a VPX on top of the SDX 14000 FIPS will not make it FIPS Compliant.

Are there advantages to operating an instance in non-FIPS mode on a NetScaler SDX FIPS appliance?

Achieving FIPS encryption standards for specific traffic requires a more intensive encrypt/decrypt process to ensure that the keys are maintained at the correct level of security integrity. If an instance operates any of its virtual servers without leveraging the FIPS encryption process specifically, the SSL transactions per second that are achievable are higher.

Performance

Why are instances or appliances configured to use FIPS mode not able to achieve the same TPS rates for SSL traffic as the non-FIPS counterparts?

Achieving FIPS encryption standards for specific traffic requires a more intensive encrypt/decrypt process to ensure that the keys are maintained at the correct level of security integrity. When an instance or appliance is using the FIPS mode of encryption, it increases the amount of time required to run an encrypt or decrypt action and this reduces the total amount of TPS that can be achieved.

The more recent FIPS appliances (VPX FIPS and MPX 8900/15000-50G FIPS) are able to operate at throughput rates that are much closer to their non-FIPS counterparts due to the architecture that NetScaler chose when designing these appliances. NetScaler no longer uses a third-party Hardware Security Module and has been able to create an appliance that offers better FIPS-encrypted throughput as a result.

Cloud

How do I get FIPS compliance in the Azure cloud?

There are two ways to achieve FIPS compliance or validation when using NetScaler VPX on Azure. One way is to directly deploy a NetScaler VPX FIPS on Azure, and leverage its design and built-in ability to provide FIPS 140-2 Level 1 validation.

The second option available is to deploy a standard NetScaler VPX and connect it to the Azure Key Vault, allowing to achieve FIPS 140-2 Level 2 and Level 3 compliance.

NetScaler VPX is also supported on Azure Government and similar options are available.

How can I tell if my NetScaler appliance is operating in FIPS mode?

If you access the appliance via SSH, you can run the command show fipsstatus at the prompt. If the appliance is operating in FIPS mode, you receive the following response.

 FipsStatus: System is operating in FIPS mode
    Done
<!--NeedCopy-->

If you do not see this message, refer Troubleshooting.

Note:

  • 13.1 FIPS is currently Module in Process. It can be used in production if there is no requirement/dependency on Compliance or validation.

  • NetScaler SDX 14000 FIPS appliances are compatible with only non-FIPS firmware, including VPX instances.

NetScaler FIPS FAQ
September 13, 2024
Contributed by: 
C
September 13, 2024
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.