Master Key Encryption on a Firewall HA Pair

High availability firewall pair master key encryption.
To use the AES-256-GCM encryption level on a firewall high availability (HA) pair, both firewalls must run PAN-OS 10.0 so that both firewalls support AES-256-GCM. If either firewall in the HA pair runs an earlier version than PAN-OS 10.0, you can’t use AES-256-GCM. When both firewalls are on PAN-OS 10.0, both firewalls can decode AES-256-CBC or AES-256-GCM encryption keys, so they can use the either encryption level. However, both firewalls should use the same encryption level to avoid the possibility of becoming out of sync.
Use AES-256-GCM encryption on both firewalls in the HA pair. Whether you use AES-256-GCM or AES-256-CBC, use the same algorithm on both firewalls.
You do not need to disable HA to change the encryption level on a firewall in an HA pair in which both firewalls run PAN-OS 10.0.

Recommended For You