Enabling FIPS on GlobalProtect fails on Windows. Error : The CPU doesn't support RDSEED/RDRAND instructions
7243
Created On 07/17/23 10:23 AM - Last Modified 07/27/24 02:00 AM
Symptom
- After enabling FIPS mode on Globalprotect, the customer gets FIPS-CC Mode Failed. Resulting in the application not connecting or doing anything
- PanGPS logs shows the FIPS-CC Error : The CPU doesn't support RDSEED/RDRAND instructions
:561 ####################### Start PanGPS service (ver: 6.1.1-5)
:048 Failed to get attribute value 'fips-cc-mode-enabled'
...(Output Omitted)....
:051 induce_error_fips_test_sha3_gps:
:051 induce_error_fips_test_dh_gps:
...(Output Omitted)....
:051 Failed to get attribute value 'fips-cc-mode-failed'
:051 FIPS-CC Error : The CPU doesn't support RDSEED/RDRAND instructions
Environment
- Windows OS with FIPS mode enabled
- Globalprotect with FIPS mode enabled
Resolution
- If FIPS fails, FIPS mode will be disabled and the customer will have to disable FIPS on GP and reinstall the application to make it functional.
- This is what you should see in PANGPS when FIPS mode is successfully enabled.
:611 Failed to get attribute value 'fips-cc-mode-failed'
:777 OS fips enabled:true
:777 FIPS-CC selftest started..
:777 test case: fips_test_drbg: PASSED
...(Output Omitted)....
:188 the file C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe is signed and the signature was verified.
:188 Subject Name: Palo Alto Networks
:188 CheckSigner return 1
:188 FIPS-CC mode : FIPS Integrity test PASSED.
:188 FIPS-CC mode enabled successfully.
- To confirm whether the CPU support RDSEED or RDRAND you can use RDRAND tester.
- You can find the RDRAND tester application on https://github.com/cjee21/RDRAND-Tester.
- The results of a successful test are shown below:
Running on AMD Ryzen 7 PRO 6850U with Radeon Graphics
This CPU supports the following instructions:
RDRAND: Supported
RDSEED: Supported
Testing RDRAND...
try: 1 success: 1 random number: 955519296989855672 (0x0d42afbcf11c7fb8)
try: 2 success: 1 random number: 9890994696216804248 (0x8943df457f467b98)
...(Output Omitted)....
try: 18 success: 1 random number: 15695213506936246795 (0xd9d099871ad9120b)
try: 19 success: 1 random number: 9680117947826199633 (0x8656affc70105c51)
try: 20 success: 1 random number: 7792075453671733622 (0x6c2303574724f976)