Strata Cloud Manager

1. Select ConfigurationNGFW and Prisma Access.
2. For the Configuration Scope, select a folder.

   The folder selection cannot be more than four levels deep.
3. Enable Device Scope Configuration for the Node 1 and Node 2 devices.

   This step is mandatory. You must enable Device Scope Configuration for both the Node 1 and Node 2 devices before initiating clustering. Without this setting enabled on both devices, the pushed clustering configuration doesn't apply.
4. Create an NGFW cluster.

   1. Select Overview, and in the Cluster Setup pane, click the gear icon or the number of clusters already configured.

   2. Select Clusters, then click Add Cluster.
   3. On the General tab, enter a Cluster Name.

   4. (Optional) Enter a Group ID (range 1–63; default 1).
5. Add devices to the cluster.

   Before you save a device selection change, verify each device's serial number. On the Select Devices tab, you can toggle device selections between the Node 1 and Node 2 panels without any warning. Assigning a firewall's serial number to a different Node ID — even by accident — clears that firewall's configuration and immediately starts a mandatory reboot of all devices in the NGFW cluster.

   What happens when a Node ID changes: Reassigning a firewall's Node ID is a platform identity change, not a simple configuration edit. When Strata Cloud Manager pushes the change, the firewall clears its previously pushed configuration, migrates local settings to the new identity, and immediately initiates a system reboot. This happens by design, whether the Node ID change was intentional or accidental — there's no confirmation prompt at the point the identity actually changes.

   1. On the Select Devices tab, select the Node 1 Device.
   2. Select the Node 2 Device.

6. Configure the HSCI-A and HSCI-B links.

   If the firewalls are directly connected by fiber, MACsec configuration is optional. If the firewalls are connected over a dark-fiber network between sites, MACsec configuration is mandatory.

   1. On the Communications tab, click + and add an Inter Firewall Link by choosing hsci-a.

   2. Enter the Key Server Priority (range 1–255).
   3. Choose a MACsec Crypto Profile and a MACsec Pre Shared Key Profile.
   4. Repeat to configure the hsci-b link.
7. Configure system monitoring for the cluster.

   1. On the System Monitoring tab, choose the State Upon Capacity Loss: degraded or failed.
   2. Enter the Minimum Network Cards required (range 1–7; default 1).
   3. Enter the Minimum Data Processing Cards required (range 1–7; default 1).
   4. Click Save.

8. (Optional) Create a MACsec policy and pre-shared key profile to apply to the HSCI ports.

   1. On the MACsec Profiles tab, Add MACsec Policy.
   2. Enter a Name for the profile (zero or more alphanumeric characters, underscores, hyphens, or dots; maximum 31 characters).
   3. Select the Encryption type: AES-128-GCM (default) or AES-256-GCM.
   4. Select the Confidentiality Offset: 0 (default), 30, or 50.
   5. (Optional) Enable SCI Include and Enable Anti Replay.
   6. Enter the Anti Replay Window size (range 0 to 65,535; default 16,384).

      Specify an Anti Replay window size based on the traffic rate because the HSCI ports will likely experience packets arriving out of order due to prioritization or load balancing in the network.
   7. Enter the SAK Rekey Interval (sec) (range 60 to 86,400; default 3,600).
   8. On the MACsec Profiles tab, Add Pre Shared Key.
   9. Enter a Name for the pre-shared key profile (zero or more alphanumeric characters, underscores, hyphens, dots, or spaces; maximum 31 characters).
   10. Enter the CKN (Connectivity Association Key Name) — 1 to 32 bytes of hexadecimal string (2 to 64 hex digits) with an even number of digits; for example, 1234.
   11. Enter the CAK (Connectivity Association Key) — a 16-byte hexadecimal string (32 hex digits) for AES-128-GCM, or a 32-byte hexadecimal string (64 hex digits) for AES-256-GCM.

       The Pre Shared Key, CKN, and CAK must match on the two ends of the HSCI-A link. Likewise, they must match on the two ends of the HSCI-B link.
   12. Save the profiles.

9. Click Save to complete the cluster-definition workflow.
10. Select the new cluster and click Initiate Clustering. At the confirmation prompt, click Yes.

    Strata Cloud Manager assigns the two devices Node 1 and Node 2, moving them from the default unclustered state. This normally triggers an automatic reboot of both devices; in some circumstances a manual reboot is required. Before assuming the reboot is complete, confirm the cluster ID and node ID appear in the device's local management interface.

11. Once the devices are up after their reboot, verify the cluster before treating it as operational.

    1. On each device's local management interface, confirm Chassis autocommit ready: True.
    2. Confirm the Dashboard's Firewall Cluster widget shows the correct Node ID and a Local Node State of online.
    3. From the CLI, confirm cluster state:

       show cluster leader
       show cluster local node-id
       show cluster local state
       show cluster all

12. (Optional) To add a second firewall to an existing single-node cluster, repeat the "Add devices to the cluster" step on the existing cluster to assign the Node 2 Device, then click Save and repeat the Initiate Clustering and verification steps above.

    The new node reboots, applies the cluster configuration, and synchronizes session state with the existing node over the HSCI links. The same serial-number caution above applies — re-opening this screen on an active cluster carries the same risk of an accidental Node ID swap on the node that's already passing traffic.