Configure a unique master key for the Panorama™ management
server and for each managed firewall.
Strengthen your security posture by configuring
a unique
master key for your Panorama™
management server and for each managed firewall. By configuring unique
master keys, you can ensure that the a compromised master key does
not compromise the configuration encryption for your entire deployment.
Unique master keys are supported only for Panorama and managed firewalls.
Log Collectors and WildFire appliances must share the same master
key as Panorama. For Panorama or managed firewalls in a high availability
(HA) configuration, you must deploy the same master key for both
HA peers as the master key is not synchronized across HA peers.
Panorama and managed firewalls support the deployment of unique
master keys by default on upgrade to PAN-OS 10.1.
Configuring
a unique master key also eases the operational burden of updating
your master keys. By configuring a unique master key for a managed
firewall, you can update each master key individually without the
need to coordinate changing the master key across a large number
of managed firewalls.
