Enable and Verify FIPS-CC Mode on Windows Endpoints

Enable FIPS mode for the Windows operating system.

To enable FIPS-CC mode for GlobalProtect, you must first enable FIPS-CC mode for the Windows operating system.

Launch the Command Prompt.
Enter
regedit
to open the Windows Registry.
In the Windows Registry, go to:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy\
.
Right-click the
Enabled
registry value and
Modify
it.
To enable FIPS mode, set the
Value Data
to
1
. The default value of
0
indicates that FIPS mode is disabled.

Click
OK
.
Restart your endpoint.

Enable FIPS-CC mode for GlobalProtect.

You cannot disable FIPS-CC mode after you enable it. To run GlobalProtect in non-FIPS-CC mode, end users must uninstall and then reinstall the GlobalProtect app. This clears all FIPS-CC mode settings from the Windows Registry.

Launch the Command Prompt.

Enter

regedit

to open the Windows Registry.

In the Windows Registry, go to:

HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\

.

Click

Edit

and then select

New

String Value

.

When prompted, specify the

Name

of the new registry value as

enable-fips-cc-mode

.

Right-click the new registry value and

Modify

it.

To enable FIPS-CC mode, set the

Value Data

to

yes

.

Click

OK

.



Restart GlobalProtect.

To enable the GlobalProtect app to initialize in FIPS-CC mode, you must restart GlobalProtect using one of the following methods:

Reboot your endpoint.

Restart the GlobalProtect application and GlobalProtect service (PanGPS):

Launch the Command Prompt.

Enter

services.msc

to open the Windows Services manager.

From the Services list, select

PanGPS

.

Restart

the service.



Alternatively, you can enable FIPS-CC mode using the following msiexec syntax through the Microsoft Windows Installer (Msiexec):

msiexec /i GlobalProtect64.msi ENABLEFIPSCCMODE=YES

Verify that FIPS-CC mode is enabled on the GlobalProtect app.

Launch the GlobalProtect app.

From the status panel, open the settings dialog ( ).

Select

About

.

Verify that FIPS-CC mode is enabled. If FIPS-CC mode is enabled, the About dialog displays the

FIPS-CC Mode Enabled

status.