Home
EN
Location
Documentation Home
Palo Alto Networks
Support
Live Community
Knowledge Base
>
Clear
Enable and Verify FIPS-CC Mode on Windows Endpoints
Updated on
Tue Sep 26 00:15:13 UTC 2023
Focus
Download PDF
Updated on
Tue Sep 26 00:15:13 UTC 2023
Focus
Home
GlobalProtect
GlobalProtect FIPS-CC Certification
Enable and Verify FIPS-CC Mode
Enable and Verify FIPS-CC Mode on Windows Endpoints
Download PDF
GlobalProtect
Enable and Verify FIPS-CC Mode on Windows Endpoints
Table of Contents
Filter
Expand All
|
Collapse All
GlobalProtect Docs
Administration
Version
10.1 & Later
9.1
User Guide
Version
6.2
6.1
6.0
5.3
5.2
5.1
New Feature
Version
6.1
6.0
5.2
5.1
Release Notes
Version
6.2
6.1
6.0
5.3
5.2
5.1
Previous
Enable and Verify FIPS-CC Mode
Next
Enable and Verify FIPS-CC Mode on macOS Endpoints
Enable and Verify FIPS-CC Mode on Windows Endpoints
Enable and verify FIPS-CC mode for GlobalProtect using the Windows Registry.
On Windows endpoints, use the following steps to enable and verify FIPS-CC mode for GlobalProtect™ using the
Windows Registry
:
Enable FIPS mode for the Windows operating system.
To enable FIPS-CC mode for GlobalProtect, you must first enable FIPS-CC mode for the Windows operating system.
Launch the Command Prompt.
Enter
regedit
to open the Windows Registry.
In the Windows Registry, go to:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy\
.
Right-click the
Enabled
registry value and
Modify
it.
To enable FIPS mode, set the
Value Data
to
1
. The default value of
0
indicates that FIPS mode is disabled.
Click
OK
.
Restart your endpoint.
Enable FIPS-CC mode for GlobalProtect.
You cannot disable FIPS-CC mode after you enable it. To run GlobalProtect in non-FIPS-CC mode, end users must uninstall and then reinstall the GlobalProtect app. This clears all FIPS-CC mode settings from the Windows Registry.
Launch the Command Prompt.
Enter
regedit
to open the Windows Registry.
In the Windows Registry, go to:
HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\
.
Click
Edit
and then select
New
String Value
.
When prompted, specify the
Name
of the new registry value as
enable-fips-cc-mode
.
Right-click the new registry value and
Modify
it.
To enable FIPS-CC mode, set the
Value Data
to
yes
.
Click
OK
.
Restart GlobalProtect.
To enable the GlobalProtect app to initialize in FIPS-CC mode, you must restart GlobalProtect using one of the following methods:
Reboot your endpoint.
Restart the GlobalProtect application and GlobalProtect service (PanGPS):
Launch the Command Prompt.
Enter
services.msc
to open the Windows Services manager.
From the Services list, select
PanGPS
.
Restart
the service.
Alternatively, you can enable FIPS-CC mode using the following msiexec syntax through the Microsoft Windows Installer (Msiexec):
msiexec /i GlobalProtect64.msi ENABLEFIPSCCMODE=YES
Verify that FIPS-CC mode is enabled on the GlobalProtect app.
Launch the GlobalProtect app.
From the status panel, open the settings dialog (
).
Select
About
.
Verify that FIPS-CC mode is enabled. If FIPS-CC mode is enabled, the About dialog displays the
FIPS-CC Mode Enabled
status.
Previous
Enable and Verify FIPS-CC Mode
Next
Enable and Verify FIPS-CC Mode on macOS Endpoints
Recommended For You