Configure the Master Key

(
HA only
) Disable HA.
This step is required before you can deploy a new master key to a firewall HA pair. If you do not disable HA before deploying a new master key, Panorama will lose connectivity to the primary firewall.
Select
Device
High Availability
General
and edit the Setup.
Disable (clear) the
Enable HA
setting and click
OK
.
Commit
your configuration changes.
Select
Device
Master Key and Diagnostics
and edit the Master Key section.
Enter the
Current Master Key
if one exists.
Define a new
New Master Key
and then
Confirm New Master Key
. The key must contain exactly 16 characters.
To specify the master key
Life Time
, enter the number of
Days
and/or
Hours
after which the key will expire.
You must configure a new master key before the current key expires. If the master key expires, the firewall or Panorama automatically reboots in Maintenance mode. You must then Reset the Firewall to Factory Default Settings.
Enter a
Time for Reminder
that specifies the number of
Days
and
Hours
before the master key expires when the firewall generates an expiration alarm. The firewall automatically opens the System Alarms dialog to display the alarm.
To ensure the expiration alarm displays, select
Device
Log Settings
, edit the Alarm Settings, and
Enable Alarms
.
(
Optional
) Select whether to use an
HSM
to encrypt the master key. For details, see Encrypt a Master Key Using an HSM.
Click
OK
and
Commit
.
(
HA only
) Re-enable HA.
Select
Device
High Availability
General
and edit the Setup.
Select
Enable HA
and click
OK
.
Commit
your configuration changes.