topic Re: Disable FIPS for HotFix install in Firewall and Security Management

Disable FIPS for HotFix install

afowler224 — Wed, 07 May 2025 12:59:31 GMT

From my understanding if FIPS is enable it must be disabled before a hotfix is applied or has that change in the new R82 12 Hotfix. I cant seem to find the right command to disable FIPs so the hotfix can be applied. Any guidance would be appreciated. I have tested the FIPs Off Command which gives me an error that FIPS cannot be disabled.

Re: Disable FIPS for HotFix install

PhoneBoy — Wed, 07 May 2025 15:11:53 GMT

By design, FIPS mode does not allow installation of JHF.
I think you have to enter two commands to disable (in this order) to disable:

fips integrity off
fips off

To re-enable it after the fact (e.g. after installing JHF):

fips on
ips integrity on

Re: Disable FIPS for HotFix install

afowler224 — Thu, 08 May 2025 19:48:50 GMT

Unfortunately I am getting an error when trying to turn off FIPS.

"The command 'fips off' is no longer supported. FIPS mode cannot be disabled"

Re: Disable FIPS for HotFix install

PhoneBoy — Thu, 08 May 2025 21:36:49 GMT

Unfortunately, you will need to do a fresh installation in this instance.

Re: Disable FIPS for HotFix install

the_rock — Fri, 09 May 2025 02:11:41 GMT

There were definitely some long discussions about this topic : - )

Sadly, I checked in R82 as well, behavior is exactly the same.

Andy

https://community.checkpoint.com/t5/General-Topics/Enable-FIPS-mode/m-p/157849#M26645

https://community.checkpoint.com/t5/Security-Gateways/FIPS-mode-operation-and-some-manual-configurations/td-p/97289

Re: Disable FIPS for HotFix install

emmap — Fri, 09 May 2025 03:59:35 GMT

From my very limited understanding it is a 'feature' of the FIPS certification that requires preservation of configuration. Otherwise you can set cyphers / encryption libraries / etc to match the FIPS standards without necessarily locking into that mode. It's not something that I have had to work with though so I am ignorant of anything more than that.