Disable FIPS for HotFix install

[afowler224]

From my understanding if FIPS is enable it must be disabled before a hotfix is applied or has that change in the new R82 12 Hotfix.  I cant seem to find the right command to disable FIPs so the hotfix can be applied.  Any guidance would be appreciated.  I have tested the FIPs Off Command which gives me an error that FIPS cannot be disabled. 

[PhoneBoy]

By design, FIPS mode does not allow installation of JHF.
I think you have to enter two commands to disable (in this order) to disable:

fips integrity off
fips off

To re-enable it after the fact (e.g. after installing JHF):

fips on
ips integrity on

[afowler224]

Unfortunately I am getting an error when trying to turn off FIPS. 

"The command 'fips off' is no longer supported. FIPS mode cannot be disabled"

[PhoneBoy]

Unfortunately, you will need to do a fresh installation in this instance.

[the_rock]

There were definitely some long discussions about this topic : - )

Sadly, I checked in R82 as well, behavior is exactly the same.

Andy

https://community.checkpoint.com/t5/General-Topics/Enable-FIPS-mode/m-p/157849#M26645

https://community.checkpoint.com/t5/Security-Gateways/FIPS-mode-operation-and-some-manual-configurat...

[emmap]

From my very limited understanding it is a 'feature' of the FIPS certification that requires preservation of configuration. Otherwise you can set cyphers / encryption libraries / etc to match the FIPS standards without necessarily locking into that mode. It's not something that I have had to work with though so I am ignorant of anything more than that.