Configure Cross-Cluster Signature Sync

1. On the active controller node (or standalone node) for each cluster you want to participate in signature sync, enable cross-cluster signature synchronization from the CLI:

   admin@WF-500(active-controller)> wildfire-cross-cluster-signature-sync enable

   admin@WF-500(active-controller)> wildfire-cross-cluster-signature-sync
   > disable          Disable WF-500 cross cluster signature sync
   > enable           Enable WF-500 cross cluster signature sync
   > list-cluster-keys  List WF-500 remote cluster API keys
   > save-cluster-key   Save WF-500 remote cluster API key
   > status           Show WF-500 cross cluster signature sync status

   You can only enable or disable signature sync on the active controller node or standalone node for that cluster or standalone appliance.
2. Log in to the Panorama web interface and select PanoramaManaged WildFire Clusters.
3. Click Push Cluster Updates to distribute the updated cluster metadata (including the signature sync enablement state) to all cluster nodes and standalone WildFire nodes managed by Panorama.

   You must push cluster updates after enabling or disabling signature sync, and after any cluster membership changes. The Push Cluster Updates button is only available when Panorama manages two or more clusters.

4. Wait for the cross-cluster signature sync daemon to consume the pushed metadata and begin operation.

   After consuming the metadata push, the daemon connects to the remote clusters to establish signature sync channels.
5. On the active controller of each participating cluster, save the API keys for all remote clusters that will participate in signature sync:

   admin@WF-500(active-controller)> wildfire-cross-cluster-signature-sync save-cluster-key

   Repeat this command for each remote cluster. You can view configured keys with:

   admin@WF-500(active-controller)> wildfire-cross-cluster-signature-sync list-cluster-keys

   Without the corresponding API keys, the signature sync status remains Unhealthy because the local cluster cannot authenticate to the remote clusters.
6. Verify the signature sync enablement state on each cluster:

   admin@WF-500> wildfire-cross-cluster-signature-sync status

   Expected output when enabled:

   Cross cluster signature synchronization status: enabled

7. Verify that signature sync is healthy by checking the cluster membership status:

   admin@WF-500(active-controller)> show cluster membership

   In the Application status section, look for the signature-sync field:

   Application status:
                   global-queue-service: JoinedCluster
                   global-db-service: Ready
                   siggen-db: ReadyMaster
                   wildfire-management-service: Done
                   wildfire-apps-service: Ready
                   signature-sync: Healthy
                       sync-from remote-cluster: Healthy

   The signature sync status field reports one of the following states:

   • Healthy—Signature sync is operational and all remote cluster connections are active.
   • Unhealthy—Signature sync is enabled but not functioning correctly (for example, API keys are missing or a remote cluster is unreachable).
   • opt-out—Signature sync is not active. This is the default state after upgrading to PAN-OS 12.2.2.
   • warning—Sync is partially operational but experiencing issues with one or more remote clusters.

   Signature sync status is visible on active and passive controller nodes only; worker nodes do not display sync status.