FIPS mode gateways use a secure configuration key that cannot be modified and it is different for each gateway.
Insert the new board and enter the default username root and password root to log in.
Change the password and configure EASG.
ADDITIONAL INFORMATION:
The following are the options:
Enable
Disable
If you are restoring from a backup, you can skip the initial gateway configuration and disable DHCP.
ADDITIONAL INFORMATION:
For example:--- Gateway Configuration Script --- The script will provide you basic gateway connectivity configuration. Configuration Script - do you want to continue (Y/N)? n
Note: The PMI is currently configured with DHCP on VLAN 1 Do you want to remove it [Y]: y
Configure the gateway for FIPS mode of operations using the following command:
ADDITIONAL INFORMATION:
set fips-mode enable
The gateway will reset.
ADDITIONAL INFORMATION:
In FIPS mode, you can only restore from a backup that was performed on the same gateway. The restore command fails if executed on a different gateway.
For example:G430-???(super)# show restore status Last restore failed with error: genError(2) - Error 210 during download file /usb0//g430na-nofips/startup_config.cfg: Failed Saving Line 4. The configuration file was encrypted with a different key. Configuration download operation was aborted.
To restore non-security data, manually remove all encrypted-* lines by editing the configuration stored in the backup file: startup_config.cfg
Usernames, SNMPv3 users, TLS identity certificates must be manually reloaded to the new gateway, even if it appears that they are restored. If you use this method of restoring non-security data after the automatic reset is performed by the restore you need to log in again using the default password.
Configure the password and save the configuration with the new password. Run the following command:
ADDITIONAL INFORMATION:
copy running-config startup-config
ADDITIONAL INFORMATION:
At the time of the backup, you need to list the usernames and the SNMPv3 users using the show usernames and show snmp user command respectively and remember to restore them after the restore operation is completed. You can run the show gw-identity h248reg|sla|syslog|web command to verify which certificates are present and should be restored.
Update the gateway serial number in Communication Manager using the value displayed in the show system command output. Run the following command:
