Device > Master Key and Diagnostics
Edit the master key that encrypts all passwords and private keys
on the firewall or Panorama (such as the RSA key for authenticating
administrators who access the CLI). Encrypting passwords and keys
improves security by ensuring their plaintext values are not exposed
anywhere on the firewall or Panorama.
The only way to restore the default master key is to perform
a
factory reset
.
Palo Alto Networks recommends you configure a new master key instead of using the default key,
store the key in a safe location, and periodically change it.
(PAN-OS 12.2.2 and later releases)
The firewall enforces master key change requirements.
When the firewall detects the default master
key, a 60-day grace period begins after which all standard commits are blocked. During
the grace period, the firewall generates a warning message during every configuration
commit. To avoid a suspension of standard configuration commits after the 60-day grace
period expires, configure a unique master key. If your operational requirements prevent
an immediate change, you can disable this enforcement feature.
The 60-day grace period begins when the
firewall detects the default master key under any of the following conditions:
- You upgrade a device to PAN-OS 12.2.2 or a later version.
- You restore a device running PAN-OS 12.2.2 or a later version to factory default
settings.
- You power on a new factory-default device running PAN-OS 12.2.2 or a later
version for the first time.
For extra privacy, you can use a hardware security module to encrypt the master key (see
Device > Setup >
HSM). Configuring a unique master key on each firewall or Panorama management
server ensures that an attacker who learns the master key for one appliance cannot
access the passwords and private keys on any of your other appliances. However, you must
use the same master key across multiple appliances in the following cases:
High availability (HA) configurations—If you deploy
firewalls or Panorama in an HA configuration, use the same master
key on both firewalls or Panorama management servers in the pair.
Otherwise, HA synchronization does not work.
Panorama managing WildFire appliances and Log Collectors—You
must configure the same master key on Panorama, WildFire appliances,
and managed collectors. Otherwise, push operations from Panorama
will fail.
To configure a master key, edit the Master Key settings and use
the following table to determine the appropriate values:
Master Key and Diagnostics
Settings | Description |
Master Key | Enable to configure a unique master key.
Disable (clear) to use the default master key. |
Current Master Key | Specify the key that is currently used to
encrypt all of the private keys and passwords on the firewall. |
New Master Key Confirm Master Key | To change the master key, enter a 16-character
string and confirm the new key. |
Life Time | Specify the number of Days and Hours after
which the master key expires. Range is 1 to 438,000 days (50 years). You
must configure a new master key before the current key expires. If
the master key expires, the firewall or Panorama automatically reboots
in Maintenance mode. You must then perform a factory reset
.
Set the Lifetime to two years or less, depending on how many encryptions
the device performs. The more encryptions a device performs, the
short the Lifetime you should set. The
critical consideration is to not run out of unique encryptions
before you change the master key. Each master key can provide up
to 2^32 unique encryptions and then encryptions repeat, which is
a security risk. Set a Time for Reminder for
the master key and when the reminder notification occurs, change
the master key. |
Time for Reminder | Enter the number of Days and Hours before
the master key expires when the firewall generates an expiration
alarm. The firewall automatically opens the System Alarms dialog
to display the alarm.
Set the reminder
so that it gives you plenty of time to configure a new master key
before it expires in a scheduled maintenance window. When the Time
for Reminder expires and the firewall or Panorama sends
a notification log, change the master key, don’t wait for the Lifetime to
expire. For grouped devices, track every device (e.g., firewalls
that Panorama manages and firewall HA pairs) and when the reminder
value expires for the any device in the group, change the master
key. To ensure the expiration alarm displays, select ,
edit the Alarm Settings, and Enable Alarms. |
Stored on HSM | Enable this option only if the master key
is encrypted on a Hardware Security Module (HSM). You cannot use
HSM on a dynamic interface such as a DHCP client or PPPoE. The
HSM configuration is not synchronized between peer firewalls in HA
mode. Therefore, each peer in an HA pair can connect to a different HSM
source. If you are using Panorama and need to keep both peer configurations
in sync, use Panorama templates to configure the HSM source on the
managed firewalls. The PA-220 does not support HSM. |
Auto Renew Master Key | Enable to automatically renew the master
key for a specified number of days and hours. Disable (clear) to
allow the master key to expire after the configured key life time. Auto
Renew with Same Master Key by specifying the number
of Days and Hours by
which to extend the master key encryption (range is 1 hour to 730
days).
If you enable Auto
Renew Master Key, set it so that the total time (lifetime
plus the auto renew time) does not cause the device to run out of
unique encryptions. For example, if you believe the device will
consume the master key’s number of unique encryptions in two and
a half years, you could set the Lifetime for
two years, set the Time for Reminder to 60
days, and set the Auto Renew Master Key for
60-90 days to provide the extra time to configure a new master key before
the Lifetime expires. However, the best practice
is still to change the master key before the lifetime expires to
ensure that no device repeats encryptions. |
|
Default Master Key Grace Period
|
Specify the number of days for the grace period during which the
firewall allows standard configuration commits while the default
master key is active. The grace period ranges from 60 days to 120
days (default is 60 days).
The grace period initiates automatically when the firewall detects
the default master key under any of the following conditions:
- You power on a brand new factory-default device running PAN-OS
12.2.2 or a later version for the first time.
- You restore a device running PAN-OS 12.2.2 or a later version to
factory default settings.
- You upgrade a device to PAN-OS 12.2.2 or a later version.
The grace period timer is not cumulative. You must configure the
extension before the current 60-day grace period expires. If the
60-day grace period elapses before you extend it or configure a
custom master key, the device fails all standard configuration
commits and HA synchronization. Only essential auto-commits will
succeed during this blocked state until you successfully apply a
custom master key.
During the grace period, the firewall displays the number of days
remaining to configure a new master key.
|
Common Criteria | In Common Criteria mode, additional options
are available to run a cryptographic algorithm self-test and software
integrity self-test. A scheduler is also included to specify the
times at which the two self-tests will run. |
(PAN-OS 12.2.2 and later releases)
Master Key Configuration for Auto Deployed Devices
()
Configure Panorama to automatically push a
custom master key to newly registering firewalls upon their first connection. This
ensures that firewalls deployed at scale never operate with the default master key,
eliminating the need to manually configure individual devices.
When a firewall registers with Panorama for
the first time, Panorama automatically deploys the configured master key along with the
specified lifetime and reminder settings. This replaces the default master key on the
firewall and re-encrypts all sensitive data. Panorama also pushes dynamic updates,
including content and antivirus (AV), to the firewall during this process.
To push the master key to newly registering firewalls, enable the
Automatically push content when software device/VM or container
or ZTP registers to Panorama checkbox in the Template Stack
associated with the target firewalls.
|
Master Key Configuration for Auto Deployed
Devices
|
Description
|
|
New Master Key
|
Enter the master key that Panorama automatically pushes to newly
registering firewalls. The key must be a 16-character string.
|
|
Confirm New Master Key
|
Re-enter the new master key to confirm it.
|
|
Lifetime
|
Specify the number of Days and
Hours after which the master key pushed
to auto-deployed firewalls expires. Range is 1 hour to 18,250 days
(50 years).
You must configure a new master key on the firewall before this
lifetime expires. If the master key expires, the firewall
automatically reboots in Maintenance mode and requires a factory
reset.
|
|
Time for Reminder
|
Enter the number of Days and
Hours before the master key expires when
the firewall generates an expiration alarm to remind you to rotate
the key. Range is 1 hour to 365 days.
|
