Privileged Access Manager offers enhanced protection against security threats and compliance with United States federal government standards by supporting Federal Information Processing Standards (FIPS). Privileged Access Manager leverages the FIPS 140-2 compliant features to meet the security requirements of United States federal agencies and customers with highly secure environments. Enabling FIPS mode in Privileged Access Manager allows the product components such as PAM Manager, Privileged Access Manager Agent, Privileged Access Manager Administration Console, Privileged Access Manager User Console, and target applications to communicate using FIPS 140-2 certified encryption algorithms.
IMPORTANT:Points to remember:
You cannot disable FIPS after you have enabled it.
When you enable FIPS:
FIPS mode is enabled immediately on all the managers that have the registry module.
The primary registry manager is enabled first, followed by the other registry managers, and then the associated agents. Automatic re-registration of agents happens once in two days. Therefore, it may take up to two days for FIPS to be enabled automatically on all the agents because FIPS is enabled when agents re-register with a manager.
For agents in Offline state, FIPS will be enabled only after the status changes to Online and the agents are re-registered with the manager.
For more information about re-registering agents manually, see the Privileged Access Manager Administration Guide.
Prerequisites:
Ensure that all the packages are upgraded to the latest version on all Privileged Access Manager agents and managers.
Enable FIPS on the operating systems hosting the managers and the agents.
FIPS mode in Privileged Access Manager can be enabled only on Windows and Linux operating systems, for both managers and agents. FIPS mode in Privileged Access Manager is not supported on Unix operating systems. For a complete list of the supported Windows and Linux operating systems, see Privileged Access Manager 4.5 System Requirements and Sizing Guidelines.
To enable FIPS:
Log in to the Privileged Access Manager Administration Console.
Click Hosts > Host Status > Enable.
Limitation: NLA (Network Level Authentication) is not supported due to FIPS limitation.
With NLA enabled on the target Windows Server, you cannot establish Web RDP connection if FIPS is enabled in PAM Framework Manager. By default, NLA requires NTLM for authentication which is not supported in the FIPS mode.