Downgrading from FIPS mode to non-FIPS mode

About this task

Downgrading from FIPS mode to non-FIPS mode clears all shared secrets, host passwords, SSH and HTTPS host keys and HTTPS certificates.
Note

Note

Once FIPS mode is enabled on the system, even if the mode is disabled at a later time, the firmware integrity test will always be carried out on the device at image copy time. The RSA2048-SHA256-based signature firmware integrity test is run during image installation time and during image reload time when the device has been administratively enabled for FIPS. The test is run on MP and LP images at image reload time, when the device is in the FIPS mode. This test is in addition to the CRC-16 test that is run by the device during image reload time. Both the tests should pass for the device to reload successfully.
Note

Note

In FIPS mode, do not attempt to downgrade to a release that does not support SHA256 signatures. Generally, releases prior to Extreme NetIron 5.6.00c (excluding 5.6.00aa) do not support SHA256 signatures. In FIPS mode, downgrading to release that does not support SHA256 signatures is not supported.
Note

Note

All shared-secret passwords (including any MD5 passwords) are lost when downgrading from a FIPS environment to a non-FIPS environment.

To place a device in non-FIPS mode and then use TFTP or SCP to download and initialize an older image, complete the following steps.

Procedure

  1. Log in to the device by entering your username and password.
  2. Disable FIPS by entering the no fips enable or no fips enable command at the prompt.
  3. Regenerate SSH host keys or other shared secrets as needed for access after reload.
  4. To replace the startup configuration with the no fips enable configuration, enter the write memory command. 
    device# write memory
  5. Reload the configuration by entering the reload command.

What to do next

9037139-00 Rev AA