> # Guidelines and Limitations

> Follow these guidelines before enabling FIPS mode:

> - Make your passwords a minimum of eight characters in length.
> - Disable Telnet. Users should log in using SSH only.
> - Disable remote authentication through RADIUS/TACACS+. Only users local to the switch can be authenticated.
> - Disable SNMP v1 and v2. Any existing user accounts on the switch that have been configured for SNMPv3 should be configured only with SHA for authentication and AES/3DES for privacy.
> - Disable VRRP.
> - Delete all IKE policies that either have MD5 for authentication or DES for encryption. Modify the policies so they use SHA for authentication and 3DES/AES for encryption.
> - Delete all SSH Server RSA1 key-pairs.

> Copyright 2010-2015, Cisco Systems, Inc. All rights reserved.