How to Enable FIPS in Reflection Desktop, Reflection 2014, or Reflection 2011

Follow the steps in this technical note to enable FIPS (Federal Information Processing Standards) mode in Reflection Desktop 16, Reflection 2014, or Reflection 2011.

For general information about FIPS mode, see:

For Reflection 2014: https://www.attachmate.com/documentation/reflection-desktop-v16-1/rdesktop-guide/data/t_6499.htm

For Reflection 2014: https://docs.attachmate.com/reflection/2014/r1/help/en/user-html/6499.htm

For Reflection 2011: https://docs.attachmate.com/reflection/2011/r3/help/en/user-html/6499.htm

Note: To successfully connect in FIPS mode, your server must support "high-encryption" capabilities. Contact your Chief Information Security Officer for information about the implications and applicability of using FIPS 140-2 validated cryptography on all of your systems.

Step 1 – Download and Copy the ReflectionPolicy.adm File

Download and unzip the Reflection policy template:

1. From the Downloads website, download the file ReflectionPolicy.zip.
2. Unzip the file to \%systemroot%\inf folder (for example, C:\Windows\inf\).

Step 2 – Install the Group Policy

To use this policy, the Reflection policy template must first be added to your Windows Group Policy editor by adding the ReflectionPolicy.adm file to the editor.

1. Run Gpedit.msc from the command line, or open the properties for an Organizational Unit in the Active Directory Users and Computers console, click the Group Policy tab, and edit or create a new policy object.
2. Expand the User Configuration tree.
3. Right-click the Administrative Templates container and select Add/Remove Templates.

View Full Size

4. In the Add/Remove Templates dialog box, click Add and browse to the \%systemroot%\inf folder (for example, “C:\Windows\inf”).
5. Select the ReflectionPolicy.adm file. Open the template, and then close the Add/Remove Templates dialog box.

Step 3 – Configure FIPS-Only Mode

Once you have added the template, use it to configure the policy.

1. In the Group Policy Object Editor, under User Configuration, expand the Administrative Templates. Expand Classic Administrative Templates (ADM).
2. Click the Reflection Settings tree and, in the right pane, double-click "Allow non-FIPS mode."

View Full Size

3. In the Allow non-FIPS mode screen, select Disabled, and then click OK.

Note: Do not change other Reflection policies included in the template.

Step 4 – Configure Reflection Security Settings

Follow these steps to configure workspace security settings.

For a VT SSL session:

1. Create a new VT session.

View Full Size

2. On the VT Document Settings screen, enter the Host name / IP address.

3. Select the "Configure additional settings" check box. Click OK.
4. Under Host Connection, click Set Up Connection Security.

5. On the SSL/TLS tab, select the "Use SSL/TLS security" check box.

6. Configure additional features as needed. Click OK.

For a 3270 or 5250 host session:

1. In the Reflection Workspace, open or create a 3270 or 5250 document.

2. On the 3270 or 5250 Document Settings pane, enter the Host name / IP Address, and select the "Configure additional settings" check box. Click OK.

3. Under Host Connection, click Set Up Connection Security.

4. Click Security Settings.
5. On the SSL/TLS tab, select the "Use SSL/TLS security" check box.
6. Configure additional features as needed. Click OK.

View Full Size

How to Configure FIPS Mode on a Per Session Basis

If you prefer to configure FIPS mode for SSH on a per session basis, rather than using the group policy as described above, follow these steps:

To configure an existing VT terminal session:

1. Open a VT terminal session and click the document settings button.

2. Click Configure Connection Settings.
3. Under Connection, select Secure Shell.
4. Enter a Host name / IP Address.
5. Click the "Security" button.

View Full Size

6. Under Host Connection, click Set Up Connection Security.
7. On the Encryption tab, select the "Run in FIPS mode" check box.
8. Click OK.

To configure a new VT terminal session:

1. Create a new VT session.
2. On the VT Document Settings pane, enter the Host name / IP address.
3. Select the "Configure additional settings" check box. Click OK.
4. Under Host Connection, click Set Up Connection Security.

Troubleshooting Tips

The following error may display if you configure the FIPS-only mode policy, but do not configure the workspace security settings:

Figure 1. The selected operation/feature is not available in FIPS mode.

The following error may display if your host does not support high-encryption:

Figure 2. Reflection SSL/TLS could not establish an encrypted connection.

Legacy KB ID

This document was originally published as Attachmate Technical Note 2216.