Due to recent changes in the PAN-OS 7.1 software release, it is important to note that for existing FIPS-enabled devices to complete the upgrade, you will need to follow the below steps.
IMPORTANT! This process will remove the existing configuration from your device, so it is mandatory to export a backup of the configuration off of the system before proceeding.
Backups saved locally on the device will be removed when making the below changes. For HA configurations, it is advised to export the configuration from both members individually.
Before attempting to upgrade, complete the following steps in order.
Step 1. Create a backup of your configuration and confirm it is valid on the remote system you have exported to before proceeding.
The following article explains the necessary procedure to export the running configuration via SCP. https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Import-Export-Running-Configuration-...
Step 2. Enter Maintenance mode. If the device is currently booted, you can enter this mode with this command:
>debug system maintenance-mode Step 3. Enable CCEAL4 Mode.
From Maintenance mode, select the option 'Set CCEAL4 Mode'
The following guide provides step-by-step instructions and images for this: https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Enable-or-Disable-Common-Criteria-CC... This will reboot the device and reset the IP address to 192.168.1.1 with the default credentials.After completing all the steps, (1-3 above), you can proceed with re-importing your running configuraiton and continue upgrading to the 7.1.x software release.
i planned to upgrade my FIPS enabled firewall from 7.0 to 7.1. i remembered to enable CCEAL4 mode, since FIPS Mode was not actually listed in maintenance mode. for that said, since my machine are already in CCEAL4 mode should i go ahead with the normal upgrade. and then go to maintenance mode to enable FIPS mode. as for 7.1 both of these mode are listed when booted. thanks,