I wanted to provide some information on how we currently post FIPS software releases on our support site (http://support.arubanetworks.com) in hopes that it will reduce confusion and help people know what to expect.
In the past, we waited until a particular software release was FIPS validated (either through initial validation, revalidation, or change letter prcess) before we posted it on the website. This made it easy for customers - if the release was available for download, it was FIPS validated. More recently, we have begun posting software as soon as it is officially released. This is primarly for two reasons:
That said, this has been a change for people who previously downloaded software from us and ran it without checking the NIST website first. To help those people out, we're going to start indicating FIPS status on the support website by creating a new folder called "FIPS validated" and placing only software images that are listed on the NIST website into that folder. We have also created a sticky thread on this forum which will always list the latest validated release, along with links to the NIST website so you can easily check it. We recommend you subscribe to this forum so that you'll be emailed updates when they happen.
On a related note, we're starting to roll out ArubaOS 6.3. Starting with 6.3, there is no longer a separate software branch and release schedule for FIPS releases. Every single 6.3 image we build will include a FIPS and a non-FIPS image, and it's our intention to post both on the support site. By default all FIPS images will be posted in the non-validated folder; we'll move them to the validated folder after validation happens (which will not be for every single release).
Please reply if there are questions, comments, or suggestions. I'm happy to try to make this easier for everyone in any way that I can.
© Copyright 2023 Hewlett Packard Enterprise Development LPAll Rights Reserved.