General Overview

1. What are Federal Information Processing Standards (FIPS)?
   FIPS are standards and guidelines for federal computer systems that are developed by National Institute of Standards and Technology (NIST) in accordance with the Federal Information Security Management Act (FISMA) and approved by the Secretary of Commerce. These standards and guidelines are developed when there are no acceptable industry standards or solutions for a particular government requirement. Although FIPS are developed for use by the federal government, many organizations and companies voluntarily use these standards.
   
   This Federal Information Processing Standards (140-2, 140-3) specifies the security requirements that will be satisfied by a cryptographic module, providing four increasing, qualitative levels intended to cover a wide range of potential applications and environments. The areas covered, related to the secure design and implementation of a cryptographic module, include specification; ports and interfaces; roles, services, and authentication; finite state model; physical security; operational environment; cryptographic key management; electromagnetic interference/electromagnetic compatibility (EMI/EMC); self-tests; design assurance; and mitigation of other attacks.
   
   For more information, please refer to https://www.nist.gov/standardsgov/compliance-faqs-federal-information-processing-standards-fips.
    

2. What is the difference between Compliant and Validated?
   A FIPS Validated, or Certified, solution is one that has been through a thorough testing process conducted by one of a handful of independent laboratories to ensure that all pieces of the product meet FIPS requirements. 
   
   A FIPS Compliant solution is one where likely only a portion of the product has been fully verified. In the case of the first two generations of NetScaler FIPS (formerly Citrix ADC) appliances, Citrix leveraged a Hardware Security Module that is fully validated as a way to provide the additional security requirements to meet FIPS level Compliance. In the current generation of appliances, NetScaler has taken on the effort of producing the specific components and having them validated directly, resulting in an ADC that is now fully Validated to meet FIPS requirements.

Form Factor and Series Options

3. What are the current FIPS options for NetScaler (formerly Citrix ADC)?
   Currently, NetScaler appliances are available in validated and compliant versions against FIPS 140-2. FIPS 140-3 validation is currently “Module In Process” (MIP) for 13.1 FIPS-based appliances with more information on this process available here (search the page for NetScaler): https://csrc.nist.gov/projects/cryptographic-module-validation-program/modules-in-process/modules-in-process-list
   
   The following table lists the available options for FIPS 140-2 appliances:

The following table lists the available options for FIPS 140-3 appliances:

4. Which NetScaler appliances (formerly Citrix ADC) are FIPS validated?
   The NetScaler MPX 8900 FIPS and MPX 15000-50G FIPS validated appliances (Cert #4043) have been tested by a third-party laboratory for the security requirements of FIPS 140-2 Level 2.
   
   The NetScaler VPX FIPS appliance is validated for FIPS 140-2 Level 1 (Cert. #3732 ). The module is available as a software package that includes both the application software and the operating system. After purchasing the NetScaler VPX FIPS license, get the latest NetScaler VPX FIPS 12.1 image from the Citrix website (https://download.citrix.com) and deploy it to a host with appropriate hardware.
   
   More information about the FIPS 140-2 standard and validation program is available on the National Institute of Standards and Technology (NIST) and the Canadian Center for Cyber Security (CCCS) Cryptographic Module Validation Program (CMVP) website at https://csrc.nist.gov/projects/cryptographic-module-validation-program.
5. Why did NetScaler develop its own cryptographic modules for FIPS Validation?
   NetScaler decided to discontinue using third-party Hardware Security Modules in the FIPS ADC appliances in order to have deeper control over the overall architecture of the appliances. The benefits of this change come in the following areas:

●       Instead of only being able to offer FIPS ADC Appliances in hardware form, the purpose-built firmware is now also packaged and licensed as a virtual appliance and this offers customers much more flexibility in how they deploy ADC’s.

●       There is no longer a dependency on a third-party company to provide the add-on hardware or the firmware that it runs. This ensures better availability of components.

●       By architecting and developing all of the software in-house, NetScaler is able to overcome performance limitations that existed due to the communication with the add-on hardware components. The end result for customers is being able to deploy FIPS appliances that perform better.

●       The most significant benefit may be that NetScaler customers are now able to deploy FIPS Validated appliances as opposed to FIPS Compliant appliances. 

FIPS Encryption / Ciphers

6. What ciphers are supported by NetScaler (formerly Citrix ADC) MPX 8900/15000-50G FIPS and VPX FIPS?
   For information on supported ciphers, please refer to https://docs.netscaler.com/en-us/citrix-adc/downloads/cipher-support-on-a-citrix-adc-vpx-fips-appliance.pdf
    

7. What key sizes are supported in VPX FIPS and MPX 8900/15000-50G FIPS series?
   Customers can use key sizes of 2048, 3072 and 4096, although only key sizes of 2048 and 3072 can be generated directly on the FIPS appliances with ssl-keygen.
    

8. What happens if I try to add non-compliant ciphers to my vServers that are using a certificate to enable FIPS encryption?
   This is not possible as the appliance will show an error because non-compliant ciphers are not supported.

Features and Functions

9. Does NetScaler (formerly Citrix ADC) FIPS include all the standard ADC functionality?
   Yes, but with the following limitations.
   
   For NetScaler MPX FIPS, TACACS authentication is not supported on the MPX FIPS validated appliances.
   
   For more information, please refer to  https://docs.citrix.com/en-us/citrix-adc/12-1/ssl/citrix-adc-mpx-fips-certified-appliance.html#limitation.
   
   For NetScaler VPX FIPS, TACACS authentication is not supported on the VPX FIPS validated appliance.
   
   For more information, please refer to https://docs.netscaler.com/en-us/citrix-adc/12-1/ssl/citrix-adc-vpx-fips-appliances.html#limitations.
   
   RADIUS is supported on both platforms as per the following: https://docs.netscaler.com/en-us/citrix-adc/12-1/ssl/citrix-adc-mpx-fips-certified-appliance.html#configure-radius-over-tls-by-using-the-cli

Upgrading NetScaler Firmware

One of the most important aspects of running a NetScaler ADC is ensuring that you keep the firmware up-to-date with a compatible version. The information in this section is intended to help you understand which firmwares are compatible with the particular NetScaler FIPS appliance that you have so that you can select an appropriate firmware when upgrades are necessary.

10. How do I know which firmware is compatible with my NetScaler ADC?
    
    NetScaler appliances run either a general firmware or FIPS firmware depending on the specific model. The naming convention for firmware will indicate whether it is a FIPS firmware by including FIPS in the name. Additionally, the naming convention will always provide information on the version and the build numbers as well. The specific model of NetScaler determines which firmware type is used. Naming examples:
    
    NetScaler ADC Release (Maintenance Phase) 13.1 Build 49.13
    Citrix ADC Release (Maintenance Phase) 13.1 Build 49.13
    This is an example of naming of a general firmware, version 13.1, build 49.13
    
    NetScaler ADC FIPS Release 13.1 Build 37.159
    Citrix ADC FIPS Release 13.1 Build 37.159
    This is an example of naming of a FIPS firmware, version 13.1, build 37.159
    
    NetScaler appliances can be upgraded to newer builds within a specific version. For example, upgrading from an older build of 12.1 FIPS to a newer build of 12.1 FIPS is an available option. While it is also possible to move from a newer build to an older build within a major version, or even move from a higher/newer version to a lower/older version of compatible firmware, this is only something that should be done by understanding the risks and implications of doing so as certain features in newer versions may not be available in older versions.
    
    The table below can be used as a guide in determining which major firmware versions are compatible based on the NetScaler appliance model.

Additional Notes on compatibility:

MPX Hardware-Software Compatibility Matrix: https://docs.netscaler.com/en-us/citrix-hardware-platforms/mpx/mpx-hardware-software-compatibility-matrix.html

SDX Hardware-Software Compatibility Matrix:https://docs.netscaler.com/en-us/citrix-hardware-platforms/sdx/sdx-hardware-software-compatibility-matrix.html

Notes on Using the SDX Single Bundle Upgrade (including minimum 12.1 version requirements to upgrade to 13.0 and beyond): https://docs.netscaler.com/en-us/sdx/current-release/single-bundle-upgrade.html

If you happen to need to upgrade from a firmware version no longer under support (12.1 or older), NetScaler Support and NetScaler Consulting Services are available to assist.
 

11. Can I upgrade to a FIPS validated version firmware from a non-FIPS version of firmware?
    No, FIPS validated firmware is a separate image. Software version upgrade from non-FIPS version to FIPS version is not supported. Also, the FIPS software version cannot be downgraded or upgraded to a non-FIPS software version. There is not an option to “convert” between a FIPS and non-FIPS validated appliance through license or firmware changes. Any appliance that was not purchased as FIPS validated will remain non-validated and should not be operated in a manner that would be compliant with FIPS.
     
12. How do I upgrade firmware on my FIPS Validated Appliances?
    The upgrade process is identical to that of the non-FIPS firmware appliances except that the FIPS-validated firmware is required (standard firmware cannot be used).
     
13. Can VPX FIPS be installed on NetScaler SDX or NetScaler SDX FIPS appliances? 
    No, VPX FIPS image is not supported on a NetScaler SDX nor NetScaler SDX FIPS appliance.
     
14. Can we upgrade or downgrade VPX to VPX FIPS or vice versa? 
    No. VPX FIPS is a separate image and cannot be upgraded or downgraded to the VPX firmware. Also, we cannot upgrade or downgrade VPX to VPX FIPS firmware.

Firmware Information and Differences

15. Can the FIPS validated build be installed on MPX series other than MPX 8900 series FIPS and MPX 15000-50G series FIPS? 
    No. FIPS validated build is only qualified to run on MPX 8900 series FIPS and MPX 15000-50G series FIPS appliances.
     
16. Can I deploy NetScaler FIPS appliances as High-Availability pairs?
    Yes. For FIPS validated MPX and VPX appliances, the HA configuration steps are the same as for non-FIPS appliances. 
    
    Prior to getting started with HA configuration, for MPX 8900 FIPS series and MPX 15000-50G FIPS series, please  refer to  https://docs.netscaler.com/en-us/citrix-adc/12-1/ssl/citrix-adc-mpx-fips-certified-appliance.html#configuration  and for VPX FIPS, please refer to  https://docs.netscaler.com/en-us/citrix-adc/12-1/ssl/citrix-adc-vpx-fips-appliances.html#configuration.
    
    For the MPX/SDX 14000 series FIPS , please refer to https://docs.netscaler.com/en-us/citrix-adc/current-release/ssl/configuring-mpx-14000-fips-appliance.html#configure-fips-on-appliances-in-an-ha-setup.
     
17. Can I deploy a NetScaler (formerly Citrix ADC) FIPS Cluster
    Yes. Configuration steps for NetScaler VPX FIPS, NetScaler MPX 8900 FIPS and MPX 15000-50G FIPS are the same as for non-FIPS appliances. For more information, please see https://docs.netscaler.com/en-us/citrix-adc/12-1/clustering.html.
     
18. Will the NetScaler  MPX 14000 FIPS commands work on NetScaler MPX 8900/15000-50G FIPS appliances?
    No. The NetScaler MPX 14000 FIPS-specific commands will not work on the latest NetScaler MPX 8900/15000-50G appliances. For more information, please see https://docs.netscaler.com/en-us/citrix-adc/12-1/ssl/citrix-adc-mpx-fips-certified-appliance.html.
     
19. Do VPX FIPS and MPX 8900/15000-50G series FIPS support Admin Partitions? Are there any differences from non-FIPS appliances?
    Yes, these FIPS series support Admin Partitions.
     
20. Which NetScaler (formerly Citrix ADC) appliances require specific firmware, and why?
    The NetScaler VPX FIPS and NetScaler MPX 8900/9100/15000-50G FIPS appliances use FIPS-validated firmware. These series meet specific design and build specifications to support the FIPS-validated firmware to achieve FIPS validated status. In the case of the MPX FIPS appliances listed here, they must run the FIPS-validated firmware to achieve the FIPS-validated status as they do not use a Hardware Security Module as previous appliances had used.
    
    All other appliances, including the MPX/SDX 14000 FIPS family, use standard firmware.

Pooled Licensing

21. Is Pooled Licensing supported on NetScaler (formerly Citrix ADC) MPX 8900/9100/15000-50G and VPX FIPS appliances?
    Yes. For NetScaler MPX FIPS, following the purchase of Zero-capacity FIPS hardware model, the appliance bandwidth capacity can be configured.
    
    For NetScaler VPX FIPS, the appliance would need a VPX FIPS instance license to be uploaded to ADM after which the instance capacity can be configured.

22. Can a common license pool be used for NetScaler FIPS and non-FIPS appliances?
    Yes. A common bandwidth pool can be shared between FIPS and non-FIPS appliances.
    
    For NetScaler MPX FIPS, a Zero-capacity FIPS hardware appliance would be required. 
    
    For NetScaler VPX FIPS, the appliance would need a VPX FIPS instance license to be uploaded to ADM after which the instance capacity can be configured.
    
    Please contact your NetScaler Sales Team for detailed information around this topic.

23. Can an existing NetScaler FIPS appliance be transitioned from perpetual to pooled license?
    Yes, NetScaler FIPS appliances can be migrated from perpetual to pooled licensing.

●       Upgrade a perpetual license in NetScaler VPX to NetScaler pooled capacity

●       Upgrading a perpetual license in NetScaler MPX to NetScaler pooled capacity

VPX FIPS

24. Which hypervisors are supported for NetScaler VPX FIPS?
    VPX FIPS is a software appliance with an overall security level of FIPS 140-2 Level 1. It executes as a virtual appliance, and was tested and found compliant on the following platforms with Intel CPU supporting RDRAND and RDSEED instruction sets:
    
    Hypervisor: VMware ESXi, KVM, Microsoft Hyper-V, Citrix Hypervisor, Microsoft Azure, AWS, and GCP
     
25. What are the prerequisites to run a NetScaler VPX FIPS appliance? 
    Please refer to the “Prerequisite” section in the following document.
    https://docs.netscaler.com/en-us/citrix-adc/12-1/ssl/citrix-adc-vpx-fips-appliances.html
     
26. How is NetScaler (formerly Citrix ADC) VPX FIPS packaged?
    The FIPS module is available as a software package that includes both the application software and the operating system. After purchasing the NetScaler VPX FIPS license, get the latest NetScaler VPX FIPS image from the Citrix website (https://download.citrix.com).
27. Where can I find NetScaler (formerly Citrix ADC) FIPS documentation?
    The following documents contain information regarding supported NetScaler FIPS appliances:
    
    FIPS Compliant Series
    MPX 14000 FIPS appliances - https://docs.netscaler.com/en-us/citrix-adc/12-1/ssl/configuring-mpx-14000-fips-appliance.html
    SDX 14000 FIPS appliances - https://docs.netscaler.com/en-us/citrix-adc/12-1/ssl/configuring-sdx-14030-14060-14080-fips-appliance.html
    
    FIPS Validated Series
    NetScaler VPX FIPS validated appliances - https://docs.netscaler.com/en-us/citrix-adc/12-1/ssl/citrix-adc-vpx-fips-appliances.html  
    NetScaler MPX 8900 FIPS and MPX 15000-50G FIPS validated appliances - https://docs.netscaler.com/en-us/citrix-adc/12-1/ssl/citrix-adc-mpx-fips-certified-appliance.html  

SDX FIPS (14000 Family of Appliances) 

28. On a NetScaler (formerly Citrix ADC) SDX FIPS appliance, are all instances automatically FIPS compliant?
    Currently, NetScaler supports only the SDX 14000 FIPS family of appliances which are FIPS compliant through the use of a third-party Hardware Security Module. When creating an instance on these appliances, each one must be individually FIPS-enabled.
     
29. Are there advantages to operating an instance in non-FIPS mode on a FIPS SDX appliance?
    Achieving FIPS encryption standards for specific traffic requires a more intensive encrypt/decrypt process to ensure the keys are maintained at the correct level of security integrity. If an instance operates any of its vServers without leveraging the FIPS encryption process specifically, the SSL transactions per second that are achievable is higher.

Performance

30. Why are instances / appliances configured to use FIPS mode not able to achieve the same TPS rates for SSL traffic as the non-FIPS counterparts?
    Achieving FIPS encryption standards for specific traffic requires a more intensive encrypt/decrypt process to ensure the keys are maintained at the correct level of security integrity. When an instance / appliance is using the FIPS mode of encryption, it increases the amount of time required to execute an encrypt or decrypt action and this reduces the total amount of TPS that can be achieved.
    
    The more recent FIPS appliances (VPX FIPS and MPX 8900/15000-50G FIPS) are able to operate at throughput rates that are much closer to their non-FIPS counterparts due to the architecture that NetScaler chose when designing these appliances. NetScaler no longer uses a third-party Hardware Security Module and has been able to create an appliance that offers much better FIPS-encrypted throughput as a result.

Cloud

31. How do I attain FIPS compliance in the Azure cloud?
    There are two ways to achieve FIPS compliance or validation when using a NetScaler VPX on Azure. One way is to directly deploy a NetScaler VPX FIPS on Azure and leverage its designed and built-in ability to provide FIPS 140-2 Level 1 validation. 
    
    The second option available is to deploy a standard NetScaler VPX and connect it to the Azure Key Vault, affording an opportunity to achieve FIPS 140-2 Level 2 & Level 3 compliance.
    
    NetScaler VPX is also supported on Azure Government and similar options are available.
     
32. How can I tell if my NetScaler (formerly Citrix ADC) appliance is operating in FIPS mode?
    If you access the appliance via SSH, you can execute the command “show fipsstatus” at the prompt. If the appliance is operating in FIPS mode, you will receive a response at the console that looks like this 

If you do not see this message, please refer to  https://docs.netscaler.com/en-us/citrix-adc/12-1/ssl/citrix-adc-vpx-fips-appliances.html#troubleshooting.