Skip to main content
You can install the FIPS 140-2 Module via a Security Patch. After the FIPS 140-2 patch is installed, you can turn it On from the Settings > Configuration > General tab.
Turning On this setting will restart OpenVPN services and cause your VPN clients to disconnect and then reconnect to the gateways.
The FIPS 140-2 approved crypto functions are described in this Security Policy PDF. According to this document, the following algorithms that Aviatrix supports are FIPS 140-2 compliant:
IPsec AlgorithmsValue
Phase 1 AuthenticationSHA-1, SHA-512, SHA-384, SHA-256
Phase 1 DH Groups2, 1, 5, 14, 15, 16, 17, 18
Phase 1 EncryptionAES-256-CBC, AES-192-CBC, AES-128-CBC, 3DES
Phase 2 AuthenticationHMAC-SHA-1, HMAC-SHA-512, HMAC-SHA-384, HMAC-SHA-256
Phase 2 DH Groups2, 1, 5, 14, 15, 16, 17, 18
Phase 2 EncryptionAES-256-CBC, AES-192-CBC, AES-128-CBC, AES-128-GCM-64, AES-128-GCM-96, AES-128-GCM-128, 3DES
SSL VPN encryption algorithm set on the server is AES-256-CBC. For OpenVPN clients running a version 2.3 or lower the negotiated algorithm would be AES-256-CBC. For OpenVPN clients running 2.4 or greater, the negotiated algorithm would be AES-256-GCM due to NCP (Negotiable Crypto Parameters). The SSL VPN authentication algorithm is SHA512.