Enabling FIPS on GlobalProtect fails on Windows. Error : The CPU doesn't support RDSEED/RDRAND instructions

Enabling FIPS on GlobalProtect fails on Windows. Error : The CPU doesn't support RDSEED/RDRAND instructions

7223
Created On 07/17/23 10:23 AM - Last Modified 07/27/24 02:00 AM


Symptom


  • After enabling FIPS mode on Globalprotect, the customer gets FIPS-CC Mode Failed. Resulting in the application not connecting or doing anything
GlobalProtect Application Page Showing FIPS disable message
  • PanGPS logs shows the FIPS-CC Error : The CPU doesn't support RDSEED/RDRAND instructions 
:561 ####################### Start PanGPS service (ver: 6.1.1-5) 
:048 Failed to get attribute value 'fips-cc-mode-enabled'
...(Output Omitted)....
:051 induce_error_fips_test_sha3_gps:
:051 induce_error_fips_test_dh_gps:
...(Output Omitted)....
:051 Failed to get attribute value 'fips-cc-mode-failed'
:051 FIPS-CC Error : The CPU doesn't support RDSEED/RDRAND instructions   
 


Environment


  • Windows OS with FIPS mode enabled
  • Globalprotect with FIPS mode enabled 


Resolution


  1.  If FIPS fails, FIPS mode will be disabled and the customer will have to disable FIPS on GP and reinstall the application to make it functional. 
  2. This is what you should see in PANGPS when FIPS mode is successfully enabled.
:611 Failed to get attribute value 'fips-cc-mode-failed'
:777 OS fips enabled:true
:777 FIPS-CC selftest started..
:777 test case: fips_test_drbg: PASSED
...(Output Omitted)....
:188 the file C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe is signed and the signature was verified.
:188 Subject Name: Palo Alto Networks
:188 CheckSigner return 1
:188 FIPS-CC mode : FIPS Integrity test PASSED.
:188 FIPS-CC mode enabled successfully.

  1. To confirm whether the CPU support RDSEED or RDRAND you can use RDRAND tester. 
  2. You can find the RDRAND tester application on https://github.com/cjee21/RDRAND-Tester.
  3. The results of a successful test are shown below:
Running on AMD Ryzen 7 PRO 6850U with Radeon Graphics
This CPU supports the following instructions:
RDRAND: Supported
RDSEED: Supported
Testing RDRAND...

try: 1 success: 1 random number: 955519296989855672 (0x0d42afbcf11c7fb8)
try: 2 success: 1 random number: 9890994696216804248 (0x8943df457f467b98)
...(Output Omitted)....
try: 18 success: 1 random number: 15695213506936246795 (0xd9d099871ad9120b)
try: 19 success: 1 random number: 9680117947826199633 (0x8656affc70105c51)
try: 20 success: 1 random number: 7792075453671733622 (0x6c2303574724f976)

 


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kIIfCAM&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language