topic Re: Not able to set the PANG admin account password after enabling FIPS-CC mode in VM-Series in the Public Cloud

Not able to set the PANG admin account password after enabling FIPS-CC mode

gustheitguy — Sun, 12 Jan 2025 06:55:55 GMT

Hello,

When I set up my AWS PANG to FIPS-CC mode I am not able to set the admin account password. I tested the paloaltonetworks.panos.panos_admpwd module before enabling FIPS-CC and it works utilizing the priv key (RSA 4096). I successfully set up one firewall on FIPS-CC and set up the admin account password. My VM Mode Amazon AWS
PANG Software Version is 10.1.14-h8. I get the following prompts via my ansible runbook:

Enter Palo Alto admin username:
Enter file path and name for key file:
Enter Palo Alto IP address:
Enter new password for admin account:

It seems to work before enabling fips-cc mode.

my ansible runbook pip file

[[source]]
url = "https://pypi.org/simple"
verify_ssl = true
name = "pypi"

[packages]
ansible-core = "*"
bcrypt = "==4.0.1"
boto3 = "==1.26.78"
botocore = "==1.29.78"
cffi = "==1.15.1"
cryptography = "==39.0.1"
jmespath = "==1.0.1"
pan-os-python = "==1.11.0"
pan-python = "==0.17.0"
paramiko = "==2.12.0"
pycparser = "==2.21"
pynacl = "==1.5.0"
python-dateutil = "==2.8.2"
s3transfer = "==0.6.0"
six = "==1.16.0"
urllib3 = "==1.26.14"
xmltodict = "==0.13.0"

[dev-packages]
ansible = "*"
ansible-lint = "*"

Any ideas on why this might not be working?

Re: Not able to set the PANG admin account password after enabling FIPS-CC mode

gustheitguy — Sun, 12 Jan 2025 08:25:23 GMT

Or maybe there is a FIPS Admin iD/password?

My steps are the following,

Build PANG PAYG firewall->set complex admin password->access web management with complex password->set up "debug system maintenace mode"->enable fips-cc via the AWS console -> reboot firewall-> attempt to log via web management with the admin account password-> fail

Re: Not able to set the PANG admin account password after enabling FIPS-CC mode

JayGolf — Thu, 16 Jan 2025 04:00:36 GMT

Hi @gustheitguy ,

I would recommend ssh via private key into the palo. Once ssh'd in , create a separate superuser and use that separate account for auth.