Using FIPS 140-2 cryptography

WhatsUp Gold provides a number of protocols for communicating with external entities consisting of:

Remote WhatsUp Gold users accessing the web interface.
WhatsUp Gold external components such as a secondary failover server, additional pollers, an external LDAP, or Active Directory server, if any of these optional components are used.
Devices on the network that provide data to WhatsUp Gold for action and storage.

Some of these protocols are insecure such as HTTP, telnet, FTP, TFTP, SNMPv1 and SNMPv2, such that an eavesdropper could intercept or even modify content used to trigger alarms and notifications. Wherever possible, Ipswitch recommends using the most secure protocols possible that employ strong encryption while avoiding insecure protocols. Secure protocols include HTTPS (SSL and TLS), SNMPv3, and SSHv2.

Note: Some passive monitors and flow monitors receive only plain text data (flow data and event logs) from network devices. Secure protocols are not available for these monitors.

When using secure protocols you need to store device credentials within WhatsUp Gold to enable communications.

WhatsUp Gold provides a FIPS mode you can set which configures WhatsUp Gold active monitors and performance monitors to use FIPS validated cryptographic algorithms for communicating with network devices. FIPS 140-2 is the Federal Information Processing Standard that specifies security requirements for a system protecting sensitive but unclassified information.

If WhatsUp Gold is installed on an operating system that is currently running in FIPS140-2 mode, WhatsUp Gold installer detects the FIPS compliant operating system and automatically places WhatsUp Gold in FIPS 140-2 mode upon initial installation and start-up. However, if WhatsUp Gold is installed on an operating system that is not running in the FIPS compliant mode or the operating system has the FIPS compliant mode enabled after a WhatsUp Gold install occurs, then you must manually enable the Operate in FIPS 140-2 mode option in the WhatsUp Gold console application Program Options General dialog. For more information, see Enabling FIPS 140-2 mode.

Note the following important considerations if you plan to operate WhatsUp Gold in FIPS 140-2 mode:

WhatsUp Gold does not recommend that you enable FIPS if you plan to use SNMPv1, SNMPv2, or SNMPv3 credentials that do not use encryption or authentication.
WhatsUp Gold recommends that SSHv2 only be used with FIPS 140-2 certified algorithms, because WhatsUp Gold in FIPS 140-2 mode does not support communications using non-certified algorithms.
SNMPv3 credentials using MD5 and DES56 are prohibited; you are unable to enable FIPS if SNMPv3 credentials using MD5 exist in the Credentials Library. You must modify or remove such credentials in order to enable FIPS.

The following may occur when you try to enable FIPS 140-2 mode in the Program Options dialog:

An error message is presented indicates that you have non-compliant SNMPv3 credentials (but you have a compliant SSL certificate):
This option is disabled because the SNMPv3 credentials are not FIPS compliant. Go to the Credentials Library to edit or remove the SNMP credentials. After editing or removing the credentials, you can enable this option in the Program Options dialog.