Citrix SD-WAN

FIPS Compliance

March 12, 2021

Contributed by:

In Citrix SD-WAN, FIPS mode enforces users to configure FIPS compliant settings for their IPsec Tunnels and IPsec settings for Virtual Paths.

Displays the FIPS compliant IKE Mode.
Displays a FIPS Compliant IKE DH Group from which users can select the required parameters for configuring the appliance in FIPS compliant mode (2,5,14 – 21).
Displays the FIPS compliant IPsec Tunnel Type in IPsec settings for Virtual Paths
IKE Hash and (IKEv2) Integrity mode, IPsec auth mode.
Performs audit errors for FIPS based Lifetime Settings

To enable FIPS compliance by using the Citrix SD-WAN GUI:

Go to Configuration > Virtual WAN > Configuration Editor > Global, and select Enable FIPS Mode.

Enabling FIPS mode enforces checks during configuration to ensure that all IPsec related configuration parameters adhere to the FIPS standards. You are prompted through audit-errors and warnings to configure IPsec.

To configure Virtual Path IPsec Settings:

Enable Virtual Path IPsec Tunnels for all Virtual Paths where FIPS compliance is required. IPsec settings for Virtual Paths are controlled via Default Sets.
Configure message authentication by changing the IPsec Mode to AH or ESP+Auth and use a FIPS approved hashing function. SHA1 is accepted by FIPS, but SHA256 is highly recommended.
IPsec lifetime should be configured for no more than 8 hours (28,800 seconds).

The Virtual WAN uses IKE version 2 with pre-shared-keys to negotiate IPsec tunnels through the Virtual Path using the following settings:

DH Group 19: ECP256 (256-bit Elliptic Curve) for key negotiation
256-bit AES-CBC Encryption
SHA256 hashing for message authentication
SHA256 hashing for message integrity
DH Group 2: MODP-1024 for Perfect Forward Secrecy

To configure IPsec Tunnel for a third party, use the following settings:

Configure FIPS approved DH Group. Groups 2 and 5 are permissible under FIPS, however groups 14 and above are highly recommended.
Configure FIPS approved hash function. SHA1 is accepted by FIPS, however SHA256 is highly recommended.
If using IKEv2, configure a FIPS approved integrity function. SHA1 is accepted by FIPS, however SHA256 is highly recommended.
Configure an IKE lifetime, and max lifetime, of no more than 24 hours (86,400 seconds).
Configure IPsec message authentication by changing the IPsec Mode to AH or ESP+Auth and use a FIPS approved hashing function. SHA1 is accepted by FIPS, but SHA256 is highly recommended.
Configure an IPsec lifetime, and max lifetime, of no more than eight hours (28,800 seconds).

To configure IPSec tunnels:

On the MCN appliance, go to Configuration > Virtual WAN > Configuration Editor. Open an existing configuration package. Go to Connections > IPSec Tunnels.
Go to Connections > IPsec Tunnels. With LAN or Intranet Tunnel selected, the screen distinguishes the FIPS-compliant groups in the IKE settings from those that are not compliant, so that you can easily configure FIPS compliance.

The screen also indicates whether the hash algorithm is FIPS compliant, as shown in the following figure.

localized image

FIPS compliance options for IPsec settings:

localized image

If the IPsec configuration does not comply with FIPS standards when it is enabled an audit error might be triggered. Following are the type of audit errors that get displayed in the GUI.

When, FIPS mode is enabled and Non-FIPS compliant option is selected.
When, FIPS mode is enabled and incorrect lifetime value is entered.
When, FIPS mode is enabled and IPsec settings for virtual path default set is also enabled, and incorrect Tunnel mode is selected (ESP vs ESP_Auth / AH).
When, FIPS mode is enabled, IPsec settings for virtual path default set are also enabled, and incorrect lifetime value is entered.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

FIPS Compliance

March 12, 2021

Contributed by:

March 12, 2021

Contributed by:

FIPS Compliance

In this article