A WildFire appliance cluster is an interconnected group of WildFire appliances that pool resources to increase sample analysis and storage capacity, support larger groups of firewalls, and simplify configuration and management of multiple WildFire appliances. This is especially useful in environments where access to the WildFire public cloud is not permitted. You can configure and manage up to twenty WildFire appliances as a WildFire appliance cluster on a single network. Clusters also provide a single signature package that the cluster distributes to all connected firewalls, high-availability (HA) architecture for fault tolerance, and the ability to manage clusters centrally using Panorama. You can also manage standalone WildFire appliances using Panorama.

When you manage multiple clusters from a single Panorama instance, you can enable cross-cluster signature synchronization so that locally generated signatures are shared across all participating clusters and standalone nodes. This ensures that threat intelligence discovered by one cluster is available to firewalls connected to other clusters without requiring each cluster to independently analyze the same samples.

A single Panorama instance can manage up to 5 WildFire appliance clusters with up to 20 nodes each, for a maximum of 100 nodes per Panorama. Panorama also provides automated cluster software upgrades, centralized health monitoring, and cluster metadata management through a push-based configuration model.