Enable FIPS Mode on Linux EndPoints with Ubuntu or RHEL

1. Ensure that FIPS-CC mode is disabled on the Linux endpoints with Ubuntu or Red Hat Enterprise Linux (RHEL) 8.1.
2. Install the GlobalProtect app on your Linux endpoint.
3. (Optional) If a client certificate is used for authentication, install and set up client certificate.
4. Modify pangps.xml to enable FIPS-CC mode.

   On Linux endpoints, the pre-deployment configuration file (pangps.xml) is located in /opt/paloaltonetworks/globalprotect.

   In pangps.xml file, under Settings, add <enable-fips-cc-mode>yes</enable-fips-cc-mode>

   For example:

   <?xml version="x.x" encoding="UTF-8"?><GlobalProtect>
            <Settings>
   			    <enable-fips-cc-mode>yes</enable-fips-cc-mode>
    	               <disable-globalprotect>0</disable-globalprotect>
            </Settings>

5. Enable FIPS-CC mode on the Linux endpoint with Ubuntu or Red Hat Enterprise Linux (RHEL) 8.1.
6. Reboot the Linux endpoint in order for the pre-deployment configuration changes to take effect.
7. Verify that FIPS-CC mode is enabled on the GlobalProtect app.

   1. Launch the GlobalProtect app.
   2. From the status panel, open the settings dialog (

      ).
   3. Select About.
   4. Verify that FIPS-CC mode is enabled. If FIPS-CC mode is enabled, the About dialog displays the FIPS-CC Mode Enabled status. For CLI version, you can use the CLI command globalprotect show --version.

      If FIPS-CC mode could not be enabled successfully, the About dialog displays the FIPS-CC Mode Failed status.

8. View the logs to view the GlobalProtect app logs related to FIPS-CC mode on Linux endpoints.
9. View, collect, and send the logs to the administrator to troubleshoot and resolve the issues related to FIPS-CC mode on Linux devices.