Per customer requirements, I am working with a FIPS 140-2 validated network switch that is actually running in FIPS mode. This guarantees that any cryptographic operations the device performs will be done with Approved algorithms.
FIPS 140-2 places very stringent requirements on the cryptographic module, and it places a very stringent test process on that cryptographic module.
What is unclear to me is when those Approved algorithms must actually be used.
For example, I cannot telnet into the device; I must use SSH. This makes perfect sense.
Similarly, I am forbidden from using HTTP to access the device's web interface. I must use HTTPS. Again, this makes perfect sense.
There are restrictions on the way I can perform remote authentication when logging into the switch. And so on and so forth...
On the other hand, when I configure syslog on the device, it is not forcing authentication and encryption upon the traffic it sends out to the collectors / relays.
Likewise with SNMP. The only thing it requires of me is that I disable SET operations. You can read from the device or receive traps all you want with no authentication or encryption. I don't even have to use SNMPv3 (which makes authentication and encryption available). It's perfectly happy to allow a read using SNMPv1 with the plaintext "public" community string.
If one wants to operate a FIPS 140-2 validated device in a FIPS-compliant manner, how do you know when you must use the Approved cryptographic algorithms the device makes available?