Deploy Console and Defenders in FIPS140-2 Level 1 mode

Download the Lagrange (22.12+) release tar bundle from the Palo Alto Networks Customer Support Portal.

Untar the release

$ tar -xzf prisma_cloud_compute_<VERSION>.tar.gz

Modify twistlock.cfg and set the FIPS_ENABLED flag to "true."

##### FIPS configuration #####
# Forces Console and Defender to use FIPS-compliant cryptography, https://csrc.nist.gov/projects/cryptographic-module-validation-program
FIPS_ENABLED=true

Deploy the Console either via the Onebox or Kubernetes deployment methods.

To confirm the Console is running in FIPS mode, login to the Console and go to Manage > Logs > Console and search for "FIPS." FIPSEnabled: true is confirmation that the Console has started in FIPS mode.

manager.go:73 Starting Console manager: ConsoleCN: STIG.lomsgaupfzzurnlkzzmxivmymh.cx.internal.cloudapp.net, ConsoleSAN: [IP:127.0.0.1 IP:10.0.1.4 IP:172.17.0.1], IsProd: true, DataRecoveryEnabled: true, DefenderPort: 8084, MgmtPortHTTPS: 8083, Version: 22.12.415, FIPSEnabled: true

To confirm that the Defender is running in FIPS mode, login to the Console and go to Manage > Defenders > Deployed Defenders in the Actions column of the Defender(s) click Logs and search for "FIPS."

defender.go:778 FIPS mode enabled true

When using the twistcli command line tool use the

FIPS_ENABLED=true

variable to enforce FIPS validated TLS communication to the Console, for example:

$ FIPS_ENABLED=true ./twistcli images scan --address https://127.0.0.1:8083 0c413668ee0d

The Jenkins plug-in communication to the Console can enforce FIPS compliant TLS traffic, enable

FIPS mode

in the Prisma Cloud Jenkins plug-in’s configuration.