Cross-Cluster Signature Sync
| Where Can I Use
This? | What Do I Need? |
|---|
Panorama WildFire Appliance
| |
Cross-cluster signature synchronization enables WildFire appliance
clusters and standalone nodes managed by a single Panorama instance to
share locally generated signatures. When enabled, threat intelligence
discovered by one cluster is replicated to all other participating
clusters and standalone nodes, ensuring that firewalls connected to
any cluster benefit from the combined analysis of all clusters in the
group.
Signature sync supports two modes:
Cluster-to-Cluster (Bidirectional)—Clusters can both
consume signatures from and share signatures with other clusters,
depending on configuration.
Standalone-to-Cluster (Unidirectional)—Standalone nodes
can only consume signatures from clusters. Standalone nodes do not
share signatures back to clusters.
Cross-cluster signature sync requires PAN-OS 12.2.2 or later. After
upgrading to PAN-OS 12.2.2, the default signature sync state is
opt-out until explicitly enabled. To
activate signature sync, you must enable it from the CLI on the active
controller node or standalone node, push cluster updates from Panorama
to distribute the cluster membership metadata, and configure API keys
for each remote cluster.
How Cross-Cluster Signature Sync Works
The primary (controller) node in each cluster exchanges signature
events with the primary nodes of all other participating clusters
over HTTPS. The synchronization uses a pull-based model where each
cluster periodically requests new signature events from peer clusters
using journal offsets to track the last synced position.
Panorama serves as the cluster registry, maintaining metadata
about all clusters in the group. When you push cluster updates from
Panorama, each cluster receives the current membership information
needed to establish peer connections. After the push, the cross-cluster
signature sync daemon consumes the new metadata and initiates
connections to the remote clusters.
For the sync daemon to authenticate to remote clusters, you must
configure API keys for each remote cluster on the active controller of
each participating cluster. Without the correct API keys, the
signature sync status reports Unhealthy
because the local cluster cannot establish authenticated connections to
the remote clusters.
Constraints and Limitations
Signature sync requires all participating clusters and standalone
nodes to be managed by the same Panorama instance.
Standalone nodes can consume signatures from clusters but cannot
share signatures back (unidirectional only).
A new cluster joining the group does not receive the full
history of previously generated signatures.
Each cluster can independently opt out of signature sync
participation.
Enable or disable signature sync only from the active controller
node or standalone node for that cluster or appliance.
A single unified cluster group exists per Panorama instance.
