Home
EN
Location
Documentation Home
Palo Alto Networks
Support
Live Community
Knowledge Base
>
Clear
Enable and Verify FIPS-CC Mode on Windows Endpoints
Updated on
Wed Aug 14 18:57:10 UTC 2024
Focus
Download PDF
Updated on
Wed Aug 14 18:57:10 UTC 2024
Focus
Home
GlobalProtect
GlobalProtect FIPS-CC Certification
Enable and Verify FIPS-CC Mode
Enable and Verify FIPS-CC Mode on Windows Endpoints
Download PDF
GlobalProtect
Enable and Verify FIPS-CC Mode on Windows Endpoints
Table of Contents
Filter
Expand All
|
Collapse All
GlobalProtect Docs
Administration
Version
10.1 & Later
9.1 (EoL)
User Guide
Version
6.3
6.2
6.1
6.0
5.1
New Feature
Version
6.1
6.0
5.1
Release Notes
Version
6.3
6.2
6.1
6.0
5.1
Previous
Enable and Verify FIPS-CC Mode
Next
Enable and Verify FIPS-CC Mode on macOS Endpoints
Enable and Verify FIPS-CC Mode on Windows Endpoints
Enable and verify FIPS-CC mode for GlobalProtect using the Windows Registry.
On Windows endpoints, use the following steps to enable and verify FIPS-CC mode for GlobalProtect™ using the
Windows Registry
:
Enable FIPS mode for the Windows operating system.
To enable FIPS-CC mode for GlobalProtect, you must first enable FIPS-CC mode for the Windows operating system.
Launch the Command Prompt.
Enter
regedit
to open the Windows Registry.
In the Windows Registry, go to:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy\
.
Right-click the
Enabled
registry value and
Modify
it.
To enable FIPS mode, set the
Value Data
to
1
. The default value of
0
indicates that FIPS mode is disabled.
Click
OK
.
Restart your endpoint.
Enable FIPS-CC mode for GlobalProtect.
You cannot disable FIPS-CC mode after you enable it. To run GlobalProtect in non-FIPS-CC mode, end users must uninstall and then reinstall the GlobalProtect app. This clears all FIPS-CC mode settings from the Windows Registry.
Launch the Command Prompt.
Enter
regedit
to open the Windows Registry.
In the Windows Registry, go to:
HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\
.
Click
Edit
and then select
New
String Value
.
When prompted, specify the
Name
of the new registry value as
enable-fips-cc-mode
.
Right-click the new registry value and
Modify
it.
To enable FIPS-CC mode, set the
Value Data
to
yes
.
Click
OK
.
Restart GlobalProtect.
To enable the GlobalProtect app to initialize in FIPS-CC mode, you must restart GlobalProtect using one of the following methods:
Reboot your endpoint.
Restart the GlobalProtect application and GlobalProtect service (PanGPS):
Launch the Command Prompt.
Enter
services.msc
to open the Windows Services manager.
From the Services list, select
PanGPS
.
Restart
the service.
Alternatively, you can enable FIPS-CC mode using the following msiexec syntax through the Microsoft Windows Installer (Msiexec):
msiexec /i GlobalProtect64.msi ENABLEFIPSCCMODE=YES
Verify that FIPS-CC mode is enabled on the GlobalProtect app.
Launch the GlobalProtect app.
From the status panel, open the settings dialog (
).
Select
About
.
Verify that FIPS-CC mode is enabled. If FIPS-CC mode is enabled, the About dialog displays the
FIPS-CC Mode Enabled
status.
Previous
Enable and Verify FIPS-CC Mode
Next
Enable and Verify FIPS-CC Mode on macOS Endpoints
Recommended For You