Configure General Cluster Settings on Panorama

1. Configure settings for the WildFire appliance cluster nodes.
   Many settings are pre-populated with either defaults, information from previously existing settings on the controller node, or the settings you just configured.
   1. Select the cluster.
   2. Select Appliance.
   3. Enter new information, keep the pre-populated information from the cluster controller node, or edit the pre-populated information, including:
      • Domain name.
      • IP address of the Primary DNS Server and the Secondary DNS Server.
      • NTP Server Address and Authentication Type of the Primary NTP Server and the Secondary NTP Server. The Authentication Type options are None, Symmetric Key, and AutoKey.
2. Configure general cluster settings.
   Many settings are pre-populated with either defaults, information from previously existing settings on the controller node, or the settings you just configured.
   1. Select the new cluster > General.
   2. (Optional) Enable DNS for the controller node to advertise the service status using DNS protocol. The cluster controller provides DNS services on the management (MGT) interface port.
   3. Register Firewall To the use the service advertised by the cluster controller(s). Palo Alto Networks recommends adding both controllers as authority servers as this provides the benefit of high-availability. Use the form:

      wfpc.service.<cluster-name>.<domain>

      For example, a cluster named mycluster in the paloaltonetworks.com domain would have the domain name:

      wfpc.service.mycluster.paloaltonetworks.com

   4. Enter the Content Update Server for the cluster. Use the default updates.paloaltonetworks.com FQDN to connect to the closest server. Check Server Identity to confirm the update server identity by matching the common name (CN) in the certificate with the IP address or FQDN of the server (this is checked by default).
   5. (Optional) Enter the public WildFire Cloud Server location or use the default wildfire.paloaltonetworks.com so that the cluster (or standalone appliance managed by Panorama) can send information to the closest WildFire cloud server. If you leave this field blank and do not connect to a WildFire cloud server, the cluster can’t receive signature updates directly from the WildFire public cloud, and can’t send samples for analysis or contribute data to the public cloud.
   6. If you connect the cluster to the public WildFire cloud, select the cloud services you want to enable:
      • Send Analysis Data—Send an XML report about local malware analysis. If you send the actual samples, the cluster doesn’t send reports.
      • Send Malicious Samples—Send malware samples.
      • Send Diagnostics—Send diagnostic data.
      • Verdict Lookup—Automatically query the WildFire public cloud for verdicts before performing local analysis to reduce the load on the local WildFire appliance cluster.
   7. Select the Sample Analysis Image to use, based on the types of samples the cluster will analyze.
   8. Configure the amount of time for the cluster to retain Benign/Grayware sample data (1-90 day range, 14 day default) and Malicious sample data (minimum 1 day, no maximum (indefinite), default is indefinite). Malicious sample data includes phishing verdicts.
   9. (Optional) Select Preferred Analysis Environment to allocate more resources to Executables or Documents, depending on your environment. The Default allocation is balanced between Executables and Documents. The available resource amount depends on the number of WildFire nodes in the cluster.
3. Check to ensure that the primary and backup Panorama servers are configured.
   If you did not configure a backup Panorama server and want to do so, you can add the backup Panorama server.
   1. Select the cluster.
   2. Select Appliance.
   3. Check (or enter) the IP address or FQDN of the primary Panorama Server and of the backup Panorama Server 2 if you are using a high availability configuration for centralized cluster management.
4. (Optional) Configure system and configuration log settings for the cluster, including log forwarding.
   1. Select the cluster.
   2. Select Logging.
   3. Select System or Configuration to configure a system or configuration log, respectively. The process for configuring them is similar.
   4. Add ( ) and Name the log forwarding instance, select the Filter, and configure the Forward Method (SNMP, Email, Syslog, or HTTP).
5. Configure administrator authentication.
   1. Select the cluster.
   2. Select Authentication.
   3. Select the Authentication Profile, either None or radius. RADIUS is the only supported external authentication method.
   4. Set the Local Authentication mode for admin users as either Password or Password Hash, and enter the Password.
6. Commit the configuration on the Panorama appliance and push it to the cluster.
   1. Commit and Push.
   2. If there are configurations on the Panorama appliance that you do not want to push, Edit Selections to choose the appliances to which you push configurations. The pushed configuration overwrites the running configuration on the cluster nodes so that all cluster nodes run the same configuration.