Every firewall and Panorama management server has a default master key that encrypts all the private keys and passwords in the configuration to secure them (such as the private key used for SSL Forward Proxy Decryption).
In a high availability (HA) configuration, ensure both firewalls or Panorama management servers in the pair use the same master key. If the master keys differ, HA configuration synchronization will not work properly.
Additionally, if you are using Panorama to manage your firewalls, you must use the same master key on Panorama and all managed firewalls so that Panorama can push configurations to the firewalls.
Be sure to store the master key in a safe location. You cannot recover the master key and the only way to restore the default master key is to Reset the Firewall to Factory Default Settings.
Configure a Master Key
Select Device > Master Key and Diagnostics and edit the Master Key section.
Enter the Current Master Key if one exists.
Define a new New Master Key and then Confirm New Master Key. The key must contain exactly 16 characters.
To specify the master key Life Time, enter the number of Days and/or Hours after which the key will expire. You must configure a new master key before the current key expires. If the master key expires, the firewall or Panorama automatically reboots in Maintenance mode. You must then Reset the Firewall to Factory Default Settings.
Enter a Time for Reminder that specifies the number of Days and Hours before the master key expires when the firewall generates an expiration alarm. The firewall automatically opens the System Alarms dialog to display the alarm. To ensure the expiration alarm displays, select Device > Log Settings, edit the Alarm Settings, and Enable Alarms.
( Optional ) Select whether to use an HSM to encrypt the master key. For details, see Encrypt a Master Key Using an HSM.
Click OK and Commit.

Related Documentation