>
    Strata Copilot
    Enable FIPS-CC Mode
    Focus
    Download PDF
    Focus
    1. Home
    2. FedRAMP
    3. Network Security FedRAMP
    4. NGFW (Hardware and VM) FedRAMP Moderate and High Requirements
    5. FedRAMP High CDSS Single SKU
    6. Enable FIPS-CC Mode
    Download PDF
    FedRAMP

    Enable FIPS-CC Mode

    Table of Contents

    Enable FIPS-CC Mode

    Enable FIPS-CC mode on your NGFW to restrict it to approved cryptographic algorithms and meet FIPS 140-2 requirements.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Strata Cloud Manager)
    • NGFW (Managed by PAN-OS or Panorama)
    • FedRAMP High CDSS Single SKU license (PAN-CDSS-GOV-CLOUD-HIGH)
    • PAN-OS 11.1 or later
    • Access to the Maintenance Recovery Tool (MRT)
    The Federal Information Processing Standard with Common Criteria (FIPS-CC) mode configures the NGFW to use approved cryptographic algorithms and enforces FIPS 140-2 compliance. FIPS-CC mode is an operational mode on the NGFW and is independent of FedRAMP High classification, which you confirm by the modifier license on the FedRAMP Customer Support Portal. You enable FIPS-CC mode using the Maintenance Recovery Tool (MRT), which is a separate boot environment for platform security configuration.
    Enabling FIPS-CC mode erases all NGFW configuration and resets the management IP address to 192.168.1.1. Back up your configuration before proceeding and schedule this change during a maintenance window. For the complete procedure, see Change the Operational Mode to FIPS-CC Mode.
    1. Access the Maintenance Recovery Tool (MRT).
      Contact the U.S. Government Technical Assistance Center (USG TAC) at the FedRAMP Customer Support Portal if you do not have MRT access. MRT provides access to the platform security configuration that is not available through the standard PAN-OS web interface or CLI.
    2. In MRT, navigate to the FIPS-CC mode settings and enable FIPS-CC mode.
      The MRT interface presents options for operational mode configuration. Enabling FIPS-CC applies the FIPS 140-2 cryptographic module settings and restricts the NGFW to approved algorithms only.
    3. Reboot the NGFW when prompted to apply the FIPS-CC mode configuration.
    4. (Optional) For NGFWs upgraded to PAN-OS 11.1, run the following CLI commands to complete the FIPS-CC configuration after the reboot.
      1. Reset the system controller:
        request sc3 reset
      2. Restart the management server process:
        debug software restart process management-server
    5. Verify FIPS-CC mode is enabled by running the following CLI command:
      show system info | match fips
      The output should include fips-cc-mode: enabled.

    © 2026 Palo Alto Networks, Inc. All rights reserved.