Panorama 10.2 M-200, M-300, M-600 and M-700

Certificate

Approved Algorithms (31)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Panorama 10.2 M-200, M-300, M-600 and M-700
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Update<br/>Firmware Load</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>status output<br/>self-test</i>"]
    C5["[low] Protocol / secure-channel<br/>references (may be KDF<br/>names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I5["Possible only, a protocol<br/>is referenced, but whether<br/>it is a live channel or<br/>only a KDF/algorithm name<br/>is unconfirmed."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R5["If a live TLS/SSH/IKE<br/>channel exists, could<br/>library CVEs apply, or is<br/>this only a<br/>KDF/documentation name?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E5["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>library identity and<br/>version ·<br/>certificate-validation<br/>behaviour · protocol-CVE<br/>disposition"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C5 --> I5 --> R5 --> E5
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C5,C6 clue;
  class I2,I3,I5,I6 infer;
  class R2,R3,R5,R6 risk;
  class E2,E3,E5,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Panorama 10.2 M-200, M-300, M-600 and M-700
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Update<br/>Firmware Load</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>status output<br/>self-test</i><br/>src: text:keyword"]
    C5["[low] Protocol / secure-channel references (may be KDF names, not a live channel)<br/><i>TLS<br/>SSH<br/>IKEV</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C5,C6 clueLow;

Security Policy, page by page

Panorama 10.2 M-200, M-300, M-600 and M-700 Version: 1.1 Revision Date: August 1, 2024 Palo Alto Networks, Inc. www.paloaltonetworks.com © 2024 Palo Alto Networks, Inc. Palo Alto Networks is a registered trademark of Palo Alto Networks. A list of our trademarks can be found at https://www.paloaltonetworks.com/company/trademarks.html. All other marks mentioned herein may be trademarks of their respective companies.

1. General The Panorama 10.2 M-200, M-300, M-600 and M-700 from Palo Alto Networks Inc., hereafter referred to as “Panorama M-Series”, “Panorama HW”, “modules”, or the “cryptographic modules” are multi-chip standalone cryptographic modules designed to fulfill FIPS 140-3 level 2 requirements. Panorama M-Series management appliances provide centralized management and visibility of Palo Alto Networks next generation firewalls. From a central location, you can gain insight into applications, users, and content traversing the firewalls. The knowledge of what is on the network, in conjunction with safe application enablement policies, maximizes protection and control while minimizing administrative effort. Your security team can centrally perform analysis, reporting, and forensics with the aggregated data over time, or on data stored on the local firewall. The Panorama M-Series management appliances’ individual management and logging components can be separated in a distributed manner to accommodate large volumes of log data. Panorama M-Series management appliances can be deployed in the following ways:

• Centralized: In this scenario, all Panorama management and logging functions are combined into a single device.
• Distributed: you can separate the management and logging functions across multiple devices, splitting the functions between managers and log collectors.
• Panorama: The Panorama manager is responsible for handling the tasks associated with policy and device configuration across all managed devices. The manager analyzes the data stored in managed log collectors for centralized reporting.
• Management-Only: Providing the ability to perform all functions of Panorama with the exception of logging.
• Log Collector: Organizations with high logging volume and retention requirements can deploy dedicated Panorama log collector devices that will aggregate log information from multiple managed firewalls.
• Panorama on the M-600 and M-700 supports an additional mode, the PAN-DB private cloud. The PAN-DB private cloud is an on-premise solution that is suitable for organizations that prohibit or restrict the use of the PAN-DB public cloud service. With this on-premise solution, you can deploy one or more M-600/M-700 appliances as PAN-DB servers within your network or data center. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 3

The cryptographic module meets the overall requirements applicable to Level 2 security of FIPS 140-3. Table 1 - Security Levels ISO/IEC 24759               FIPS 140-3 Section Title                Security Section 6.                                                         Level
2        Cryptographic Module Specification                     2
3        Cryptographic Module Interfaces                        2
6        Operational Environment                               N/A
7        Physical Security                                      2
9        Sensitive Security Parameter Management                2
11        Life-Cycle Assurance                                   3
12        Mitigation of Other Attacks                           N/A
Overall Level                                 2 © 2024 Palo Alto Networks, Inc.                                                        Panorama HW 10.2 Security Policy 4

2. Cryptographic Module Specification The configurations for this validation are highlighted in Table
3. Table 2 - Hardware Tested Configuration Module Hardware Firmware Version Distinguishing Features Panorama M-200 Physical Kit: 920-000208 Panorama M-300 Physical Kit: 920-000319 Panorama M-600 Panorama M-700 Approved Mode of Operation The following procedure will initialize the modules into the Approved mode of operation: ● Install physical kit opacity shields and tamper evidence seals according to the Physical Security Policy section. physical kits must be correctly installed to operate in the Approved mode of operation. The tamper evidence seals and opacity shields shall be installed for the module to operate in a Approved mode of operation. ● During initial boot up, break the boot sequence via the console port connection (by pressing the maint button when instructed to do so) to access the main menu. ● Select “Continue.” ● Select the “Set FIPS-CC Mode” option to initialize the Approved mode. ● Select “Enable FIPS-CC Mode”. ● When prompted, select “Reboot” and the module will re-initialize and continue into the Approved mode of operation (FIPS-CC mode). ● The module will reboot. ● In FIPS-CC mode, the console port is available only as a status output port. ● Once the module has finished booting, the Crypto Officer can authenticate using the default credentials that come with the module o Once authenticated, the module will automatically require the operator to change their password; and the default credential is overwritten The module will automatically indicate the Approved mode of operation in the following manner: ● Status output interface will indicate “**** FIPS-CC MODE ENABLED ****” via the CLI session. ● Status output interface will indicate “FIPS-CC mode enabled successfully” via the console port. ● The module will display “FIPS-CC” at all times in the status bar at the bottom of the web interface. ● The module will display “fips-cc” when “show system info” is entered via the CLI Should one or more power-up self-tests fail, the Approved mode of operation will not be achieved. Feedback will consist of: © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 5

• The module will output “FIPS-CC failure”
• The module will reboot and enter a state in which the reason for the reboot can be determined.
• To determine which self-test caused the system to reboot into the error state, connect the console cable and follow the on-screen instructions to view the self-test output. Note: Disabling FIPS-CC mode causes a complete factory reset, which is described in the Zeroization section below. Selecting Panorama, Management-Only, Log Collector, and PAN-DB System Modes Panorama M-Series appliances support multiple configurations that provide varying services. The Cryptographic Officer can initialize the module into different system modes. The primary and default system mode is the Panorama mode. The Management-Only system mode is the same as Panorama mode except there is no log collecting service. The Log Collector system mode is a secondary mode that provides a focused log collecting and forwarding capability. Directions to convert the appliance into the Log Collector mode are discussed below. The M-600 and M-700 provide a fourth system mode, PAN-DB Private Cloud server. Convert the M-200/M-300/M-600/M-700 appliance from Panorama mode to the Management-Only mode:
• Log into the CLI via SSH
• Enter “request system system-mode management-only”
• Enter “Y” to confirm the change to Management-Only mode.
• The system will reboot and perform the required power on self-tests. Convert the M-200/M-300/M-600/M-700 appliance from Management-Only mode to the Panorama mode:
• Log into the CLI via SSH
• Enter “request system system-mode panorama”
• Enter “Y” to confirm the change to Panorama mode.
• The system will reboot and perform the required power on self-tests. Convert the M-200/M-300/M-600/M-700 appliance from Panorama mode to the dedicated Panorama Log Collector mode:
• Log into the CLI via SSH
• Enter “request system system-mode logger”
• Enter “Y” to confirm the change to Panorama Log Collector mode.
• The system will reboot and perform the required power on self-tests. Convert the M-200/M-300/M-600/M-700 appliance from Panorama Log Collector mode to the Panorama mode:
• Log into the CLI via SSH
• Enter “request system system-mode panorama”
• Enter “Y” to confirm the change to Panorama mode.
• The system will reboot and perform the required power on self-tests. Convert the M-600/M-700 appliance from Panorama Manager mode to the dedicated PAN-DB Private Cloud mode:
• Log into the CLI via SSH
• Enter “request system system-mode panurldb”
• Enter “Y” to confirm the change to PAN-DB Private Cloud mode.
• The system will reboot and perform the required power on self-tests. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 6

Convert the M-600/M-700 appliance from PAN-DB mode to the Panorama Manager mode:

• Log into the CLI via SSH
• Enter “request system system-mode panorama”
• Enter “Y” to confirm the change to Panorama mode.
• The system will reboot and perform the required power on self-tests. NOTE: Changing the System Mode does not change the FIPS-CC Mode. Non-Compliant State Failure to follow the directions in the Approved Mode of Operation above or rules noted in Section 11 will result in the module operating in a non-compliant state, which is considered out of scope of this validation. Zeroization The following procedure will zeroize the module and must be performed under the control of the operator:
• Access the module’s CLI via SSH, and command the module to enter maintenance mode (“debug system maintenance-mode”); the module will reboot
• Note: Establish a serial connection to the console port
• After reboot, select “Continue.”
• Select “Factory Reset”
• The module will perform a zeroization, and provide the following message once complete: o “Factory Reset Status: Success” Approved and Allowed Algorithms The following table details the cryptographic algorithms and their algorithm certificates. Only the algorithms, modes, and key sizes specified in this table are used by the module. The CAVP certificate may contain more tested options than listed in this table. Table 3 - Approved Algorithms Vetted conditioning component for ESV Component Vetted conditioning component for ESV 800-90B Vetted conditioning component for ESV A2906 CBC 128, 192 and 256 bits Decryption © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 7

Counter DRBG A2906                            Counter DRBG    AES 256 bits with Derivation Function Enabled     Random Bit Generator ECDSA KeyGen                                                                            Key Generation ECDSA KeyVer (FIPS                                                                      Public Key Validation HMAC            HMAC-SHA-1 with λ=96, 160                         Authentication for protocols HMAC                                                              Authentication for protocols HMAC            HMAC-SHA2-256 with λ=256                          Authentication for protocols HMAC            HMAC-SHA2-384 with λ=384                          Authentication for protocols HMAC            HMAC-SHA2-512 with λ=512                          Authentication for protocols A2906                                                                                              Key Exchange Engine ID: KDF SNMP [SP A2906                             SSHv2 KDF                                                         SSH +++ This Hash algorithm is not supported for ANSI X9.31 Digital Signature Non-Digital Signature Applications (e.g. component of HMAC) Digital Signature Non-Digital Signature Applications (e.g. component of HMAC) © 2024 Palo Alto Networks, Inc.                                                              Panorama HW 10.2 Security Policy 8

Non-Digital Signature Applications (e.g. component of HMAC) Digital Signature Non-Digital Signature Applications (e.g. component of HMAC) Digital Signature Non-Digital Signature Applications (e.g. component of HMAC) Safe Primes Key Safe Primes Key Safe Primes Key Safe Primes Key A2906 and [SP 800-38F]        wrapping and           256 bits of encryption strength unwrapping) per IG D.G. SP 800-38D and SP KTS                                        128 and 256-bit keys providing 128 or 256 bits Cert. #                           wrapping and                                                               Key Wrapping A2906                             unwrapping) per IG D.G. SP 800-90B          ESV                    Palo Alto Networks DRNG Entropy Source              Entropy SP 800-90B          ESV                    Palo Alto Networks DRNG Entropy Source              Entropy SP 800-90B          ESV                    Palo Alto Networks DRNG Entropy Source              Entropy SC Cert. KAS-ECC per IG D.F                                                         Key Exchange with protocol KDF KDF SSH       800-56Arev3]                               192, or 256 bits of encryption strength Scenario 2 path (2). SC Cert. KAS-ECC per IG D.F                                                         Key Exchange with protocol KDF KDF TLS       800-56Arev3]                               192, or 256 bits of encryption strength Scenario 2 path (2). SC Cert. #A2906,       KAS [SP                                    2048-bit key providing 112 bits of encryption KAS-FFC per IG D.F                                                         Key Exchange with protocol KDF Scenario 2 path (2). SC Cert.      KAS [SP                                    2048-bit key providing 112 bits of encryption KAS-FFC per IG D.F                                                         Key Exchange with protocol KDF Scenario 2 path (2). KDF TLS © 2024 Palo Alto Networks, Inc.                                                                      Panorama HW 10.2 Security Policy 9

Key Generation Cryptographic Key Vendor      CKG                 Section 5.1, Section                                            Note: Seeds used for asymmetric key Generation; SP 800Affirmed    (SP 800-133rev2)    5.2                                                             pair generation are produced using the

unmodified/direct output of the DRBG The module is compliant to IG C.H: GCM is used in the context of TLS and SSH:

• For TLS, The GCM implementation meets Scenario 1 of IG C.H: it is used in a manner compliant with SP 800-52 and in accordance with Section 4 of RFC 5288 for TLS key establishment, and ensures when the nonce_explicit part of the IV exhausts all possible values for a given session key, that a new TLS handshake is initiated per sections 7.4.1.1 and 7.4.1.2 of RFC 5246. During operational testing, the module was tested against an independent version of TLS and found to behave correctly.
• From this RFC 5288, the GCM cipher suites in use are: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, and TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• For SSH, the module meets Scenario 1 of IG C.H. The module conforms to RFCs 4252, 4253, and 5647. The fixed field is 4-byte in length and is derived using the SSH KDF; this ensures the fixed field is unique for any given GCM session. The invocation field is 8-byte in length and is incremented for each invocation of GCM; this prevents the IV from repeating until the entire invocation field space of 264 is exhausted, which can take hundreds of years. (In FIPS-CC Mode, SSH rekey is automatically configured at 1 GB of data or 1 hour, whichever comes first.) In all the above cases, the nonce_explicit is always generated deterministically. AES GCM keys are zeroized when the module is power cycled. For each new TLS or SSH session, a new AES GCM key is established. The module is compliant to IG C.F: The module utilizes Approved modulus sizes 2048, 3072, and 4096 bits for RSA signatures. This functionality has been CAVP tested as noted above. The minimum number of Miller Rabin tests for each modulus size is implemented according to Table C.2 of FIPS 186-4. For modulus size 4096, the module implements the largest number of Miller-Rabin tests shown in Table C.2. RSA SigVer is CAVP tested for all three supported modulus sizes as noted above. The module does not perform FIPS 186-2 SigVer. All supported modulus sizes are CAVP testable and tested as noted above. The module does not implement RSA key transport in the approved mode. The module does not have any algorithms that fall under: - Non-Approved Algorithms Allowed in the Approved Mode of Operation - Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed - Non-Approved Algorithms Not Allowed in the Approved Mode of Operation © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 10

Table 4 - Supported Protocols in the Approved Mode TLSv1.2 SSHv2 SNMPv3 *Note: these protocols were not reviewed or tested by the CMVP or CAVP. Module Diagrams Figures 1 - 8 depict the modules and their interfaces. Please refer to the appendices for depictions of the modules with the physical kits installed. Figure 1 - M-200 Front Figure 2 - M-200 Rear Figure 3 - M-300 Front Figure 4 - M-300 Rear Figure 5 - M-600 Front © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 11

Figure 6 - M-600 Rear Figure 7 - M-700 Front Figure 8 - M-700 Rear 3. Cryptographic Module Interfaces The modules are multi-chip standalone modules with ports and interfaces as shown below. The modules do not implement a control output interface. Table 5 - Ports and Interfaces Physical Interface Logical Interface Data that passes over port/interface LED Status output Module status via LED indicators RJ45 Console Status output Self-test output © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 12

RJ45 Ethernet Data input, control input, control output, TLS, SSH data output, status output 4. Roles, Services, and Authentication Assumption of Roles The module supports distinct operator roles. The cryptographic module in Panorama mode, Management-Only mode, or PAN-DB mode enforces the separation of roles using unique authentication credentials associated with operator accounts. The Log Collector mode only supports one role, the Crypto-Officer (CO) role. The module supports concurrent operators. The module does not provide a maintenance role or bypass capability. Table 6 – Roles, Service Commands, Input and Output Query module for version Module provides version CO Show Version Configuring and managing Confirmation of service via System Provisioning CLI or WebUI Access web portal Connect to web portal from TLS Confirmation of service via Access CLI Connect to SSH server from SSH Confirmation of service via Panorama Firmware Update Loading new image Message output noting version CO updated successfully via System Panorama Manager Setup Configuring and managing Confirmation of service via Manager configurations (e.g., Configuration Logs Manage Panorama Configuring and managing Confirmation of service via Administrative Access Administrative configurations Configuration Logs CO (e.g., creating user accounts, setting authentication method, Configure High Availability Configuring and managing High Confirmation of service via via CLI or WebUI © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 13

Panorama Certificate               Configuring and managing             Confirmation of service via Management                         certificates via CLI or WebUI        Configuration Logs Panorama Log Setting               Configuring and managing log Confirmation of service via settings via CLI or WebUI            Configuration Logs Panorama Server Profiles           Configuring and managing             Confirmation of service via CO                                          Server configurations (e.g.          Configuration Logs Setup Managed Devices and          Configuring and managing             Confirmation of service via Deployment                         Managed Devices configurations Configuration Logs Configure Managed Log              Configuring and managing             Confirmation of service via CO       Collectors                         Managed Log Collectors               Configuration Logs CO,      Zeroize                            Zeroize from CLI                     Zeroization Indicator CO, User, Self-Test                            Run self-test via CLI or WebUI     Output results via System Logs Show Status                        Show status via CLI or WebUI       FIPS-CC Mode Indicator System Audit                   View system audit records via Audit records via System Logs Monitor System Status and Logs View system status records via System status via System Logs Panorama Log Collector Setup   Configuring and managing Log Confirmation of service via Collectors configurations via CLI Configuration Logs Panorama Pan-DB Setup          Configuring and managing          Confirmation of service via CO                                      Pan-DB URL configurations via Configuration Logs Manage Pan-DB Administrative Configuring and managing            Confirmation of service via Access                         Administrator password via CLI Configuration Logs Table 7 - Roles and Authentication Role          Authentication Method                        Authentication Strength Username/password) and/or       Minimum length is eight1 (8) characters (95 possible characters). Single-Factor Cryptographic     The probability that a random attempt will succeed or a false Software (certificate common    acceptance will occur is 1/(958) which is less than 1/1,000,000. name / public key-based         The probability of successfully authenticating to the module authentication)                 within one minute is 10/(958), which is less than 1/100,000. The module’s configuration supports at most ten failed attempts to authenticate in a one-minute period. In FIPS-CC Mode, the module checks and enforces the minimum password length of eight (8) as specified in SP 800-63B. Passwords are securely stored hashed with salt value, with very restricted access control, and rate limiting mechanism for authentication attempts. © 2024 Palo Alto Networks, Inc.                                                          Panorama HW 10.2 Security Policy 14

Certificate/Public key-based The security modules support public-key based authentication Memorized Secret (Unique 2048, RSA 3072, RSA 4096, ECDSA P-256, P-384, or P-521. Single-Factor Cryptographic The minimum equivalent strength supported is 112 bits. The Software (certificate common probability that a random attempt will succeed is 1/(2112) which is User less than 1/1,000,000. The probability of successfully name / public key-based authentication) authenticating to the module within a one minute period is 10/(2112), which is less than 1/100,000. The module in FIPS-CC mode allows at most 10 failed attempts before a lockout occurs. Access Control Policy While in the Approved mode of operation all authenticated services and CSPs are accessed via authenticated SSH or TLS sessions. Access is restricted to authenticated operators only and no interface is provided to modify the public or private key. SNMPv3 authentication is supported but is not a method of module administration and does not allow read/write access of CSPs. Approved and allowed algorithms, relevant CSP and public keys related to these protocols are used to access the following services. CSP access by services is further described in the following tables. Additional service information and administrator guidance for Panorama can be found at https://docs.paloaltonetworks.com/. The Crypto-Officer may access all services, and through the “management of administrative access” service may define multiple Crypto-Officer roles with limited services. The User role provides read-only access to the System Audit service. When configured in the default mode, Panorama Manager provides services via web-browser based interface and a command line interface (CLI). For the Panorama Log Collector mode and PAN-DB mode, only the CLI is available for management. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 15

SSP Access Rights The table below defines the relationship between access to CSPs and the different module services. The modes of access shown in the table are defined as: G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g. the SSP is output). W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP. Table 8 - Approved Services Service                Description                Approved Security Functions         Keys and/or SSPs      Roles   Access rights to          Indicator Keys and/or SSPs Show Version            Query the module to display N/A                                      N/A                    CO       N/A                Version displayed via the version                                                                                                             System Logs / CLI / UI Perform panorama debug functions, manage Panorama support information and switch between Panorama                                                                                                        System and System Provisioning                                  N/A                                     N/A                   CO        N/A Logger modes. (Panorama or Access web portal       Connect to module’s web      RSA SigVer (186-4)                      CA Certificates        CO       G/R/E/W            System Logs portal to invoke services. RSA SigVer (186-4)                      RSA Public Keys                 G/R/E/W (Panorama or                 ECDSA SigVer (186-4)                    ECDSA Public Keys               G/R/E/W CKG,              TLS DHE/ECDHE                   G/E/Z ECDSA KeyGen      Private Components (FIPS 186-4), ECDSA KeyVer (FIPS 186-4), Safe Primes Key    Public Components Primes Key KTS                                     TLS HMAC Keys                   G/E/Z AES-CBC            TLS Encryption Keys             G/E/Z KTS                  AES-GCM            TLS Encryption Keys             G/E/Z Counter DRBG, ESV                       DRBG Seed                       G/E DRBG V DRBG Key Entropy Input String © 2024 Palo Alto Networks, Inc.                                                                                      Panorama HW 10.2 Security Policy 16

AccessCLI PanoramaFirmware Update PanoramaManagerSetup

Connecttomodule’sCLIvia SSH Downloadandinstall firmwareupdates Presentsconfiguration optionsformanagement interfacesand communicationforpeer services(e.g.,SNMP, RADIUS). Import,Export,Save,Load, revertandvalidate Panoramaconfigurations andstaterole (Panoramaor Management-OnlyMode)

KTS KTS KAS CounterDRBG,ESV RSASigVer(FIPS186-4) CKG RSAKeyGen(FIPS186-4) RSASigGen(FIPS186-4) CKG ECDSAKeyGen (FIPS186-4) ECDSASigGen (FIPS186-4) RSASigVer(FIPS186-4) ECDSASigVer(FIPS186-4) KDFSNMP(CVL) KDFSNMP(CVL) HMAC-SHA-1 HMAC-SHA2-224 HMAC-SHA2-256 HMAC-SHA2-384 HMAC-SHA2-512 AES-CFB128 RSASigVer(FIPS186-4) ECDSASigVer (FIPS186-4) KAS KTS

HMAC-SHA-1 HMAC-SHA2-256 HMAC-SHA2-512 AES-CBC AES-CTR AES-GCM KDFSSH(CVL) KAS-ECC-SSC KAS-FFC-SSC SafePrimesKey Generation SafePrimesKey Verification KDFTLS(CVL) KDFTLS(CVL) CKG, ECDSAKeyGen (FIPS186-4), ECDSAKeyVer (FIPS186-4), KAS-ECC-SSC, KAS-FFC-SSC, SafePrimesKey Generation,Safe PrimesKey Verification HMAC-SHA2-256 HMAC-SHA2-384 AES-CBC

SSHSession AuthenticationKeys SSHSession EncryptionKeys SSHDHE/ECDHE PrivateComponents SSHDHE/ECDHE PublicComponents DRBGSeed DRBGV DRBGKey EntropyInputString PublicKeyfor FirmwareLoadTest RSAPrivateKeys ECDSAPrivateKeys RSAPublicKeys ECDSAPublicKeys SNMPv3 AuthenticationSecret SNMPv3Privacy Secret SNMPv3 AuthenticationKey SNMPv3SessionKey CACertificates TLSPre-Master Secret TLSMasterSecret TLSDHE/ECDHE PrivateComponents TLSDHE/ECDHE PublicComponents TLSHMACKeys TLSEncryptionKeys

CO,User CO CO

G/E/Z G/E/Z G/E/Z G/E/Z G/E/R/W/Z G/E W/E G/W/E G/W/E G/R/E/W G/R/E/W W/E W/E G/E/Z G/E/Z G/R/E/W G/E/Z G/E/Z G/E/Z G/E/R/W/Z G/E/Z G/E/Z

SystemLogs Systemand Configurationlogs Systemand Configurationlogs

Access CLI               Connect to module’s CLI via KTS                 HMAC-SHA-1    SSH Session                  CO, User   G/E/Z       System Logs AES-CTR            Encryption Keys Private Components Safe Primes Key Safe Primes Key Counter DRBG, ESV                      DRBG Seed                          G/E DRBG V DRBG Key Entropy Input String Panorama Firmware        Download and install        RSA SigVer (FIPS 186-4)                Public Key for          CO         W/E         System and Update                   firmware updates                                                   Firmware Load Test                             Configuration logs Panorama Manager Setup Presents configuration        CKG                                    RSA Private Keys        CO         G/W/E       System and options for management        RSA KeyGen (FIPS 186-4)                                                               Configuration logs interfaces and                RSA SigGen (FIPS 186-4) communication for peer CKG                                    ECDSA Private Keys                 G/W/E ECDSA KeyGen ( FIPS 186-4) ECDSA SigGen revert and validate (FIPS 186-4) Panorama configurations and state role                RSA SigVer (FIPS 186-4)                RSA Public Keys                    G/R/E/W ECDSA SigVer (FIPS 186-4)              ECDSA Public Keys                  G/R/E/W (Panorama or Management-Only Mode)       KDF SNMP (CVL)                         SNMPv3                             W/E Authentication Secret RSA SigVer (FIPS 186-4)               CA Certificates                    G/R/E/W ECDSA SigVer (FIPS 186-4) KAS                  KDF TLS (CVL)     TLS Pre-Master                     G/E/Z CKG,               TLS DHE/ECDHE                      G/E/Z ECDSA KeyGen       Private Components (FIPS 186-4), TLS DHE/ECDHE                      G/E/R/W/Z ECDSA KeyVer Public Components (FIPS 186-4), Safe Primes Key Primes Key AES-CBC            TLS Encryption Keys                G/E/Z © 2024 Palo Alto Networks, Inc.                                                                                       Panorama HW 10.2 Security Policy 17

AES-CBC,           SSH Session                    G/E/Z KAS                 KDF SSH (CVL)      SSH DHE/ECDHE                  G/E/Z Safe Primes Key Primes Key SSH DHE/ECDHE                  G/E/R/W/Z Public Components Counter DRBG, ESV                      DRBG Seed               CO     G/E         System and DRBG V                                     Configuration Logs DRBG Key Entropy Input String Manage Panorama         Define access control       N/A                                      CO, User Password       CO     G/E/W       System and Administrative Access   methods via admin profiles,                                                                                     Configuration logs configure administrators Configure local user profiles, sequence of       RSA SigVer (FIPS 186-4)                  SSH Client Public Key          W/E methods and access Management-Only, or Log Collector Mode)               RSA SigVer (FIPS 186-4)                SSH Host Public Key            G/R/E/W ECDSA SigVer (FIPS 186-4) Configure High          Configure High Availability   RSA SigVer (FIPS 186-4)                RSA Public Key          CO     G/R/E/W     Configuration Logs Availability            communication settings (Panorama or ECDSA SigVer (FIPS 186-4)              ECDSA Public Key               G/R/E/W Panorama Certificate    Manage RSA/ECDSA              ECDSA SigGen                           RSA Private Keys        CO     G/R/W/E     System and Management              certificates and private      (FIPS 186-4)                           ECDSA Private Keys                         Configuration logs keys, certificate profiles,   RSA SigGen revocation status, and        (FIPS 186-4) usage; show status. © 2024 Palo Alto Networks, Inc.                                                                                       Panorama HW 10.2 Security Policy 18

(Panorama,                      ECDSA SigVer        RSA Public Keys                   G/R/W/E Management-Only, or Log         (FIPS 186-4)        ECDSA Public Keys Collector Mode)                 RSA SigVer (FIPS 186-4) Counter DRBG, ESV   DRBG Seed                         G/E DRBG V DRBG Key Entropy Input String Panorama Log Setting       Configure log forwarding        N/A                 N/A                    CO         N/A       Configuration Logs (Panorama or Panorama Server Profiles   Configure communication KDF SNMP (CVL)              SNMPv3                CO          W/E       System Logs parameters and information                          Authentication Secret for peer servers KDF SNMP (CVL)           SNMPv3 Privacy                    W/E (Panorama or Setup Managed Devices      Set-up and define managed N/A                       N/A                    CO         N/A       Configuration Logs and Deployment             devices, device groups for Configure device deployment applications and licenses View current deployment information on the managed firewalls. It also allows you to manage firmware versions and schedule updates on the managed firewalls and managed log (Panorama or Configure Managed Log      Setup and manage other         N/A                  CO, User Password      CO         G/E/W     System and Collectors                 Log Collector management,                                                                       Configuration logs communication and storage View current deployment information on the managed Log Collectors. It also allows you to manage firmware versions and schedule updates on managed log (Panorama or Zeroize                    Zeroize all SSPs                N/A                 All SSPs               CO         Z         Zeroization Indicator Self-Test                  Run power up self-tests on      N/A                 Firmware Integrity     CO, User   E         System Logs demand by power cycling                             Verification Key the module. © 2024 Palo Alto Networks, Inc.                                                                         Panorama HW 10.2 Security Policy 19

Show Status               View status of the module     N/A                                    N/A                  CO, User   N/A         FIPS-CC Mode Indicator System Audit              Allows review of limited    N/A                                      N/A                  CO, User   N/A         System Logs configuration and system status via SNMPv3, logs, configuration screens. configuration commit PAN-DB Mode) Monitor System Status and Review system status via      N/A                                    N/A                  CO, User   N/A         System Logs Logs                      the panorama system CLI, CKG                                    RSA Private Keys     CO         G/W/E       System and Panorama Log Collector    Presents configuration        RSA KeyGen (FIPS 186-4)                                                            Configuration logs Setup                     options for management        RSA SigGen (FIPS 186-4) interfaces and communication for peer revert and validate           ECDSA KeyGen Panorama configurations       ( FIPS 186-4) and state.                    ECDSA SigGen (FIPS 186-4) (Log Collector Mode only) RSA SigVer (FIPS 186-4)                RSA Public Keys                 G/R/E/W ECDSA SigVer (FIPS 186-4)              ECDSA Public Keys               G/R/E/W KAS                 KDF TLS (CVL)      TLS Pre-Master                  G/E/Z CKG,              TLS DHE/ECDHE                   G/E/Z ECDSA KeyGen       Private Components (FIPS 186-4), ECDSA KeyVer (FIPS 186-4), Safe Primes Key    Public Components Primes Key © 2024 Palo Alto Networks, Inc.                                                                                       Panorama HW 10.2 Security Policy 20

AES-CBC            TLS Encryption Keys           G/E/Z KTS                 AES-GCM            TLS Encryption Keys           G/E/Z AES-CBC,           SSH Session                   G/E/Z AES-CTR            Encryption Keys KAS                 KDF SSH            SSH DHE/ECDHE                 G/E/Z Private Components Safe Primes Key Primes Key Counter DRBG, ESV                      DRBG Seed                     G/E DRBG V DRBG Key Entropy Input String Panorama Pan-DB Setup   Presents configuration        KAS                 KDF TLS (CVL)      TLS Pre-Master         CO     G/E/Z      System Logs options for management                                               Secret interfaces and communication for peer revert and validate                               KDF TLS (CVL)      TLS Master Secret             G/E/Z Panorama configurations and state. (PAN-DB Mode only) © 2024 Palo Alto Networks, Inc.                                                                                      Panorama HW 10.2 Security Policy 21

CKG,              TLS DHE/ECDHE                G/E/Z ECDSA KeyGen       Private Components (FIPS 186-4), ECDSA KeyVer (FIPS 186-4), Safe Primes Key    Public Components Primes Key AES-CBC            TLS Encryption Keys          G/E/Z KTS                 AES-GCM            TLS Encryption Keys          G/E/Z AES-CBC,           SSH Session                  G/E/Z AES-CTR            Encryption Keys KAS                 KDF SSH            SSH DHE/ECDHE                G/E/Z Private Components Safe Primes Key Primes Key Counter DRBG, ESV                      DRBG Seed                    G/E DRBG V DRBG Key Entropy Input String © 2024 Palo Alto Networks, Inc.                                                                 Panorama HW 10.2 Security Policy 22

ManagePan-DB AdministrativeAccess

UpdateAdministrator password. (PAN-DBModeonly)

N/A

CO,UserPassword

CO

G/E/W

Systemand Configurationlogs

Manage Pan-DB Update Administrator N/A CO, User Password CO G/E/W System and Administrative Access password. Configuration logs (PAN-DB Mode only) Note: Configuration/System Logs for Approved services above will indicate FIPS-CC mode is enabled and that the service succeeded.

5. Software/Firmware Security The module performs the Firmware Integrity test by using HMAC-SHA-256 and ECDSA signature verification (HMAC and ECDSA Cert. #A2906) during the Pre-Operational Self-Test. In addition, the module also conducts the firmware load test by using RSA 2048 with SHA-256 (Cert. #A2906) for the new validated firmware to be uploaded into the module. The pre-operational self-tests can be initiated by power cycling the module. When this is performed, the module automatically runs the cryptographic algorithm self-tests in addition to the pre-operational firmware integrity test.
6. Operational Environment The FIPS 140-3 Area 5 Operational Environment requirements are not applicable because the module contains a non-modifiable operational environment. The operational environment is limited since the module includes a firmware load service to support necessary updates. New firmware versions within the scope of this validation must be validated through the FIPS 140-3 CMVP. Any other firmware loaded into this module is out of the scope of this validation and requires a separate FIPS 140-3 validation.
7. Physical Security Physical Security Mechanisms The multi-chip standalone modules are production quality containing standard passivation. Chip components are protected by an opaque enclosure. There are tamper-evident seals that are applied on the modules by the Crypto-Officer. There are fifteen (15) for the M-200, fifteen (15) for the M-300, twenty-one (21) for the M-600, and twenty-one (21) for the M-700. All unused seals are to be controlled by the Crypto-Officer. The seals prevent removal of the opaque enclosure without evidence. The Crypto-Officer must ensure that the module surface is clean and dry. Tamper evident seals must be pressed firmly onto the adhering surfaces during installation and once applied, the Crypto-Officer shall permit 24 hours of cure time for all tamper evident seals. The seals prevent removal of the opaque enclosure without evidence. The Crypto-Officer should inspect the seals and shields for evidence of tamper every 30 days. If the seals show evidence of tamper, the Crypto-Officer should assume that the modules have been compromised and contact support. Note: For ordering information, see Table 2 for physical kit part numbers and versions. Opacity shields are included in the physical kits. Operator Required Actions The following table provides information regarding the various physical security mechanisms, and their recommended frequency of inspection/test. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 23

Table 9 - Physical Security Inspection Guidelines Physical Security Recommended Frequency Inspection/Test Guidance Details Tamper Evident 30 days (M-200, M-300) Verify integrity of tamper-evident seals in the Seals locations identified in Section 7 of this Security Policy.

30 days (M-200, M-300) Verify that opacity shields and side rails have not

Front and Rear been loosened or deformed from their original shape, thereby Opacity Shields reducing their effectiveness. Side Rails Top Overlays 30 days (M-200, M-300) Verify top overlays have not been removed or deformed. All edges should maintain strong adhesion Tamper Evident 30 days (M-600, M-700) Verify integrity of tamper-evident seals in the Seals locations specified in Section 7 of this Security Policy. Front and Rear 30 days (M-600, M-700) Verify that the front and rear opacity shields Opacity Shields have not been deformed from their original shape, thereby reducing their effectiveness. Vent Overlays 30 days (M-600, M-700) Verify that the vent overlays have not been removed or deformed. All edges should maintain strong adhesion Refer to the following sections for instructions on installation and placement of the tamper seals and opacity shields. M-200 Tamper Seal Installation (15 Seals) 1. Replace the top cover with the physical top cover. a. Remove the VOID WARRANTY label and cover screws (replacement label included in the kit). M-200 appliance—Remove the Void Warranty label that covers the left top cover screw then use a Phillips-head screwdriver to remove both screws as indicated in the illustration. b. Simultaneously depress the two (2) release buttons on top of the cover and slide the cover toward the back of the appliance to remove it. c. Slide the top cover (does not have vents) on the appliance until the release buttons click. Reinsert and slide cover into position and secure with the two (2) screws. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 24

Figure 9 – M-200: Top Cover Replacement © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 25

2. On the left side of the M-200, firmly apply seven (7) tamper-evident seals as indicated in the illustration. Figure 10 – M-200: Side View Before Rail Installation Install the inner rack mount rail brackets as described in the “M-200 and M-600 Appliance Hardware Reference”. The front rack bracket that you replace in the next step is located on the front inner rails. Figure 11 – M-200: Inner Rack Mount Rail Brackets
3. Attach the front cover brackets. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 26

Replace the front rack-mount brackets (one bracket on each side) that are part of the inner-rack rails with the rack-mount brackets by removing and then reinstalling two screws on each bracket. The handles have standoffs that are used to secure the front cover. Figure 12

• M-200: Replacing Front Rack-Mount Brackets 4. Attach the physical kit front cover to the front of the appliance. Slide the M-200 physical kit front cover over the brackets and secure the cover by turning the thumb screws clockwise (one thumb screw on each side). Figure 13
• M-200: Attach Physical Kit Front Cover © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 27

5. Attach the physical kit back cover to the back of the appliance. Slide the back cover onto the back of the appliance, insert two M4 x 0.7 x 8mm (one (1) screw on each side), and turn the screws clockwise to secure the cover.
6. Apply a tamper-evident seal to each location shown in the following M-200 illustrations. Ensure you apply two (2) tamper-evident seals on the power supplies (see seals #14 and #15 on the rear illustration). Before you apply the tamper-evident seals, ensure that the appliance and physical kit surfaces are clean and dry. Firmly press one (1) seal on to each of the locations shown in the illustrations. Avoid touching the seals for at least 24 hours to allow time for the seals to properly adhere to the appliance and physical kit surfaces. Figure 14 – M-200: Seal locations on Top and Right Side Figure 15 – M-200: Seal Locations on Left Side and Rear M-300 Tamper Seal Installation (15 Seals)
7. Replace the top cover with the FIPS top cover. a. Remove the VOID WARRANTY label and cover screws (replacement label included in the kit). © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 28

M-300 appliance—Remove the Void Warranty label that covers the left top cover screw then use a Phillips-head screwdriver to remove both screws as indicated in the illustration. b. Simultaneously depress the two (2) release buttons on top of the cover and slide the cover toward the back of the appliance to remove it. c. Slide the physical kit top cover (does not have vents) on the appliance until the release buttons click. Reinsert and slide cover into position and secure with the two (2) screws. Figure 16 – M-300: Top Cover Replacement © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 29

2. On the left side of the M-300, firmly apply seven (7) tamper-evident seals as indicated in the illustration. Figure 17 – M-300: Side View Before Rail Installation Install the inner rack mount rail brackets as described in the “M-300 and M-700 Appliance Hardware Reference”. The front rack bracket that you replace in the next step is located on the front inner rails. Figure 18 – M-200: Inner Rack Mount Rail Brackets
3. Attach the physical kit front cover brackets. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 30

Replace the front rack-mount brackets (one bracket on each side) that are part of the inner-rack rails with the physical kit rack-mount brackets by removing and then reinstalling two screws on each bracket. The physical kit handles have standoffs that are used to secure the front cover. Figure 19

• M-300: Replacing Front Rack-Mount Brackets 4. Attach the physical kit front cover to the front of the appliance. Slide the M-300 physical kit front cover over the physical kit brackets and secure the cover by turning the thumb screws clockwise (one thumb screw on each side). Figure 20
• M-300: Attach Physical Kit Front Cover © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 31

5. Attach the physical kit back cover to the back of the appliance. Slide the back cover onto the back of the appliance, insert two M4 x 0.7 x 8mm (one (1) screw on each side), and turn the screws clockwise to secure the cover.
6. Apply a tamper-evident seal to each location shown in the following M-300 illustrations. Ensure you apply two (2) tamper-evident seals on the power supplies (see seals #14 and #15 on the rear illustration). Note: Before you apply the tamper-evident seals, ensure that the appliance and physical kit surfaces are clean and dry. Firmly press one (1) seal on to each of the locations shown in the illustrations. Avoid touching the seals for at least 24 hours to allow time for the seals to properly adhere to the appliance and physical kit surfaces. Figure 21 – M-300: Seal locations on Top and Right Side Figure 22 – M-300: Seal Locations on Left Side and Rear M-600 Tamper Seal Installation (21 Seals)
7. Replace the top cover with the FIPS top cover. a. Remove the VOID WARRANTY label and cover screws (replacement label included in the kit). © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 32

Remove the Void Warranty label that covers the left side cover screw then use a Phillips-head screwdriver to remove both screws as indicated in the illustration. b. Simultaneously depress the two (2) release buttons on top of the cover and slide the cover toward the back of the appliance to remove it. c. Slide the physical kit top cover (does not have vents) on the appliance until the release buttons click. Replace the two screws that you removed from the old cover Figure 23 – M-600: Top Cover Replacement 2. Attach the physical front cover brackets. Remove the front pull handles by removing two (2) screws from each handle (one (1) handle on each side), insert the M-600 physical kit front-cover brackets under each handle, and then replace the handles and secure them using the screws that you removed. The physical kit handles have standoffs that are used to secure the front cover. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 33

Figure 24 – M-600: Front Cover Bracket

3. Attach the physical kit front cover to the front of the appliance. Slide the M-600 physical kit front cover over the physical kit pull handle brackets and secure the cover by turning the thumb screws clockwise (one thumb screw on each side). Figure 25 – M-600: Physical Kit Front Cover
4. Install a tamper-evident seal on the back of the appliance. This is seal #13 in the M-600 Figure
5. You need to install this seal before you install the M-600 physical kit back cover.
6. Attach the physical kit back cover to the back of the appliance. a. Slide the back cover onto the back of the appliance and turn the two (2) thumb screws clockwise until tight (one (1) screw on each side) to secure the cover.
7. Apply a tamper-evident seal to each location shown in the following M-600 illustrations below. Also install the overlay stickers to cover vent openings (two (2) stickers on each side). You then install © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 34

tamper-evident seals over the overlay stickers. Apply two (2) tamper-evident seals on the back side of the right rack handle (see seals #18 and #19 on the left side in Figure 54). Apply two (2) tamper-evident seals on the power supplies (see seals #11 and #12 with rear inset of Figure 53). Note: Before you apply the tamper-evident seals, ensure that the appliance and physical kit surfaces are clean and dry. Firmly press one (1) seal on to each of the locations shown in the illustrations. Avoid touching the seals for at least 24 hours to allow time for the seals to properly adhere to the appliance and physical kit surfaces. M-600 Seal Placement (21 Seals) Figure 26 – M-600: Tamper Seal Locations (Top and Rear) © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 35

Figure 27

• M-600: Tamper Seal Locations (Top and Front) Figure 28
• M-600: Tamper Seals Location for Side Rails M-700 Tamper Seal Installation (21 Seals) 7. Replace the top cover with the physical kit top cover. a. Remove the VOID WARRANTY label and cover screws (replacement label included in the kit). Remove the Void Warranty label that covers the left side cover screw then use a Phillips-head screwdriver to remove both screws as indicated in the illustration. b. Simultaneously depress the two (2) release buttons on top of the cover and slide the cover toward the back of the appliance to remove it. c. Slide the physical kit top cover (does not have vents) on the appliance until the release buttons click. Replace the two screws that you removed from the old cover © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 36

Figure 29 – M-700: Top Cover Replacement

8. Attach the physical kit front cover brackets. Remove the front pull handles by removing two (2) screws from each handle (one (1) handle on each side), insert the M-700 physical kit front-cover brackets under each handle, and then replace the handles and secure them using the screws that you removed. The physical kit handles have standoffs that are used to secure the front cover. Figure 30 – M-700: Front Cover Bracket
9. Attach the physical kit front cover to the front of the appliance. Slide the M-700 physical front cover over the physical kit pull handle brackets and secure the cover by turning the thumb screws clockwise (one thumb screw on each side). © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 37

Figure 31 – M-700: Physical Kit Front Cover

10. Install a tamper-evident seal on the back of the appliance. This is seal #13 in the M-700 Figure
11. You need to install this seal before you install the M-700 physical kit back cover.
12. Attach the physical kit back cover to the back of the appliance. a. Slide the back cover onto the back of the appliance and turn the two (2) thumb screws clockwise until tight (one (1) screw on each side) to secure the cover.
13. Apply a tamper-evident seal to each location shown in the following M-700 illustrations below. Also install the overlay stickers to cover vent openings (two (2) stickers on each side). You then install tamper-evident seals over the overlay stickers. Apply two (2) tamper-evident seals on the back side of the right rack handle (see seals #18 and #19 on the left side in Figure 54). Apply two (2) tamper-evident seals on the power supplies (see seals #11 and #12 with rear inset of Figure 53). Note: Before you apply the tamper-evident seals, ensure that the appliance and physical kit surfaces are clean and dry. Firmly press one (1) seal on to each of the locations shown in the illustrations. Avoid touching the seals for at least 24 hours to allow time for the seals to properly adhere to the appliance and physical kit surfaces. M-700 Seal Placement (21 Seals) Figure 32 – M-700: Tamper Seal Locations (Top and Rear) © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 38

Figure 33

• M-700: Tamper Seal Locations (Top and Front) Figure 34
• M-700: Tamper Seals Location for Side Rails 8. Non-Invasive Security There are currently no defined Approved non-invasive attack mitigation test metrics in SP 800-140F. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 39

9. Sensitive Security Parameters The following table details all the sensitive security parameters utilized by the module. Table 10 - SSPs Used to trust a root CA RSA SigVer (FIPS                                                                   HDD – intermediate CA and TLS or SSH                                                            leaf /end entity CA Certificates    112 bits minimum                                  Session Key      N/A                                                  certificates at session

managed as certificates for the verification of RSA SigVer                       Session Key and peer RSA Private keys for HDD – Zeroize        generation of RSA SigGen                       TLS or SSH                                       Service              signatures, managed as certificates for the verification of and peer ECDSA SigGen                     TLS or SSH                                       Service              generation of signatures Ephemeral values used Zeroize at session   in key agreement Private            112 bits minimum KAS-FFC-SSC        800-56A Rev. N/A               N/A           RAM - plaintext Ephemeral values used Public             112 bits minimum KAS-FFC-SSC        800-56A Rev.                   N/A           N/A Secret value used to TLS Pre-Master                      KDF TLS                                                                           Zeroize at session N/A                                 800-56A Rev. N/A               N/A           RAM – plaintext                        Secret along with client

3 and server random

© 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 40

Secret value used to TLS Master                             KDF TLS                                                                         Zeroize at session N/A                               KDF TLS      N/A             N/A              RAM – plaintext                         derive the TLS session TLS Encryption                                                                     TLS, KAS SP                         Zeroize at session   keys used in TLS
112 bits minimum KAS-FFC-SSC      800-56A Rev. N/A             N/A              RAM - plaintext
112 bits minimum KAS-FFC-SSC      800-56A Rev.                 N/A              RAM - plaintext
112 bits minimum                               N/A             N/A                                 Zeroize Service
Public RSA key used to RSA SigVer SSH Client Public                                                  Encrypted via                    HDD/RAM –                               authenticate client.
112 bits minimum (FIPS 186-4)     N/A                          N/A                                 Zeroize Service

Used in all SSH connections to the security module’s

128 bits minimum                  KDF SSH      N/A                              RAM - plaintext                         command line interface.
used in all SSH connections to the SSH Session                                                                                                                                 security module’s Authentication      160 bits minimum                 KDF SSH       N/A                              RAM - plaintext                         command line interface Used to check the integrity of Firmware                                                                                                                                    crypto-related code. This is not considered an Used to authenticate Public Key for                         RSA SigVer                                                                                           firmware and content to Firmware Load       112 bits           (FIPS 186-4)   N/A          N/A             N/A                                  N/A                 be installed on the Authentication string N/A                               External                     N/A                                                      with a minimum length of eight (8) characters. Encrypted via                     HDD/RAM –          Zeroize             Secrets used by RADIUS Protocol Secrets    N/A                N/A            N/A                          N/A © 2024 Palo Alto Networks, Inc.                                                                                 Panorama HW 10.2 Security Policy 41

Entropy input string Entropy as                                                               coming from the Entropy Input                       DRBG
256 bits                              per          N/A             N/A       RAM - plaintext   Power cycle     entropy source
SP 800-90B Input length = 384 bits affirmed), Counter                                                                         DRBG seed coming from Entropy as DRBG                                                                                       the entropy source DRBG Seed         256 bits                              per          N/A             N/A       RAM - Plaintext   Power cycle SP 800-90B Cert. #A2906                                                                               Seed length = 384 bits Entropy as DRBG                                                                                        state Key used in the generation of a random SP 800-90B Entropy as DRBG                                                                                        state V used in the DRBG V           128 bits                              per          N/A             N/A       RAM - plaintext   Power cycle generation of a random SP 800-90B Used to support SNMPv3 Authentication                      KDF SNMP                        Encrypted via               HDD/RAM –        Zeroize (Minimum 8 characters) Used to support SNMPv3 SNMPv3 Privacy                      KDF SNMP                        Encrypted via               HDD/RAM –        Zeroize (Minimum 8 characters) Authentication   160 bits minimum               KDF SNMP            N/A             N/A Privacy protocol
128 bits minimum                    KDF SNMP       N/A             N/A                                         encryption key

(AES-CFB 128) Note: SSPs are implicitly zeroized when power is lost, or explicitly zeroized by the zeroize service. In the case of implicit zeroization, the SSPs are implicitly overwritten with random values due to their ephemeral memory being reset upon power loss. For the zeroization service and zeroization at session termination, the SSP's memory location is overwritten with random values. Table 11 – Non-Deterministic Random Number Generation Specification Entropy Source Minimum number of Details bits of entropy Palo Alto Networks DRNG 256 bits Entropy Source Entropy source provides full entropy, which is provided in the 384 bit seed. 10. Self-Tests The cryptographic module performs the following tests below. The operator can command the module to perform the power-up self-test by cycling power of the module; these tests do not require any operator action. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 42

Pre-operational Self-Tests Pre-operational Firmware Integrity Test

• Verified with HMAC-SHA-256 and ECDSA P-256 Note: the ECDSA and HMAC-SHA-256 KATs are performed prior to the Firmware Integrity Test Conditional self-tests Cryptographic algorithm self-tests
• AES 128-bit ECB Encrypt Known Answer Test
• AES 128-bit ECB Decrypt Known Answer Test
• AES 128-bit CMAC Known Answer Test*
• AES 256-bit GCM Encrypt Known Answer Test
• AES 256-bit GCM Decrypt Known Answer Test
• AES 192-bit CCM Encrypt Known Answer Test*
• AES 192-bit CCM Decrypt Known Answer Test*
• RSA 2048-bit PKCS#1 v1.5 with SHA-256 Sign Known Answer Test
• RSA 2048-bit PKCS#1 v1.5 with SHA-256 Verify Known Answer Test
• RSA 2048-bit Encrypt Known Answer Test*
• RSA 2048-bit Decrypt Known Answer Test*
• ECDSA P-256 with SHA-512 Sign Known Answer Test
• ECDSA P-256 with SHA-512 Verify Known Answer Test
• HMAC-SHA-1 Known Answer Test
• HMAC-SHA-256 Known Answer Test
• HMAC-SHA-384 Known Answer Test
• HMAC-SHA-512 Known Answer Test
• SHA-1 Known Answer Test
• SHA-256 Known Answer Test
• SHA-384 Known Answer Test
• SHA-512 Known Answer Test
• DRBG SP 800-90Arev1 Instantiate/Generate/Reseed Known Answer Tests
• SP 800-90Arev1 Instantiate/Generate/Reseed Section 11.3 Health Tests
• SP 800-56Ar3 KAS-FFC-SSC 2048-bit Known Answer Test
• SP 800-56Ar3 KAS-ECC-SSC P-256 Known Answer Test
• SP 800-135rev1 TLS 1.2 with SHA-256 KDF Known Answer Tests
• SP 800-135rev1 SSH KDF with SHA-256 Known Answer Tests
• SP 800-135rev1 IKEv2 KDF Known Answer Tests* Note: Supported by the module cryptographic implementation, but only utilized for CAST
• SP 800-90B RCT/APT Health Tests on Entropy Source Note: The SP 800-90B Health Tests are implemented by the entropy source. *Note: Supported by the module cryptographic implementation, but only utilized for CAST Conditional Pairwise Consistency Self-Tests
• RSA Pairwise Consistency Test
• ECDSA/KAS-ECC Pairwise Consistency Test
• KAS-FFC Pairwise Consistency Test Conditional Firmware Load test
• Firmware Load Test
• Verify RSA 2048 with SHA-256 signature on firmware at time of load © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 43

Conditional Critical Functions Tests ● SP 800-56A Rev. 3 Assurance Tests (Based on Sections 5.5.2, 5.6.2, and 5.6.3) Error Handling In the event of a conditional test failure, the module will output a description of the error. These are summarized below. Table 12 - Errors and Indicators Cause of Error Error State Indicator Conditional Cryptographic Algorithm Self-Test or Firmware FIPS-CC mode failure. <Algorithm test> failed. Integrity Test Failure Conditional Pairwise Consistency or Critical Functions Test System log prints an error message. Conditional Firmware Load Test Failure System prints Invalid image message.

11. Life-cycle Assurance The vendor provided life-cycle assurance documentation that describes configuration management, design, finite state model, development, testing, delivery + operation, end of life procedures, and guidance. For details regarding the secure installation, initialization, startup, and operation of the module, see section “Modes of Operation”. Palo Alto Network provides an Administrator Guide for additional information noted in the “References” section of this Security Policy. Module Enforced Security Rules The module design corresponds to the module security rules. This section documents the security rules enforced by the cryptographic module to implement the security requirements of this FIPS 140-3 Level 2 module.
12. The cryptographic module shall provide distinct operator roles. When the module has not been placed in a valid role, the operator shall not have access to any cryptographic services.
13. The cryptographic module shall provide identity-based authentication.
14. The cryptographic module shall clear previous authentications on power cycle.
15. The module shall support the generation of key material with the approved DRBG. The entropy provided must be greater than or equal to the strength of the key being generated.
16. Data output shall be inhibited during power-up self-tests and error states.
17. Processes performing key generation and zeroization processes shall be logically isolated from the logical data output paths.
18. The module does not output intermediate key generation values.
19. Status information output from the module shall not contain CSPs or sensitive data that if misused could lead to a compromise of the module.
20. There are no restrictions on which keys or CSPs are zeroized by the zeroization service.
21. The module maintains separation between concurrent operators.
22. The module does not support a maintenance interface or role.
23. The module does not have any external input/output devices used for entry/output of data.
24. The module does not enter or output plaintext CSPs. © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 44

Vendor imposed security rules In FIPS-CC mode, the following rules shall apply:

1. When FIPS-CC mode is enabled, the operator shall not install plugins. a. Checked via CLI using “show plugins installed”
2. When FIPS-CC mode is enabled, the operator shall not use TACACS+. RADIUS may be used but must be protected by TLS protocol. a. Checked via CLI using “show deviceconfig” command Key to Entity The cryptographic module associates all keys (secret, private, or public) stored within, entered into or output from the module with authenticated operators of the module. Keys stored within the module are only made available to authenticated operators via TLS or SSH. Keys are only input or output from the module by the authenticated operator via a SSH or TLS protected communication. Any attempt to intervene in the key to entity relationship would require defeating the module TLS or SSH encryption and authentication/integrity mechanism.
3. Mitigation of Other Attacks The module is not designed to mitigate any specific attacks outside the scope of FIPS 140-3. These requirements are not applicable.
4. References [FIPS 140-3] FIPS Publication 140-3 Security Requirements for Cryptographic Modules [AGD] Panorama Administrator’s Guide Version 10.2
5. Definitions and Acronyms AES – Advanced Encryption Standard CA – Certificate Authority CLI – Command Line Interface CO – Crypto-Officer CSP – Critical Security Parameter CVL – Component Validation List DB9 – D-sub series, E size, 9 pins DES – Data Encryption Standard DH – Diffie-Hellman DRBG – Deterministic Random Bit Generator EDC – Error Detection Code ECDH – Elliptical Curve Diffie-Hellman ECDSA – Elliptical Curve Digital Signature Algorithm FIPS – Federal Information Processing Standard © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 45

HMAC

• (Keyed) Hashed Message Authentication Code KDF
• Key Derivation Function LED
• Light Emitting Diode RJ45
• Networking Connector RNG –Random number generator RSA
• Algorithm developed by Rivest, Shamir and Adleman SHA
• Secure Hash Algorithm SNMP
• Simple Network Management Protocol SSH
• Secure Shell TLS
• Transport Layer Security USB
• Universal Serial Bus VGA
• Video Graphics Array © 2024 Palo Alto Networks, Inc. Panorama HW 10.2 Security Policy 46