End-of-Life (EoL)
Configure General Cluster Settings on Panorama
Some general settings are optional and some
general settings are pre-populated with default values. It’s best
to at least check these settings to ensure that the cluster configuration
matches your needs. General settings include:
- Connecting to the WildFire public cloud and submitting samples to the public cloud.
- Configuring data retention policies.
- Configuring logging.
- Setting the analysis environment (the VM image that best matches your environment) and customizing the analysis environment to best service the types of samples the firewalls submit to WildFire.
- Set IP addresses for the DNS server, NTP server, and more.
- Configure settings for the WildFire appliance cluster nodes.Many settings are pre-populated with either defaults, information from previously existing settings on the controller node, or the settings you just configured.
- Select the cluster.
- SelectAppliance.
- Enter new information, keep the pre-populated information from the cluster controller node, or edit the pre-populated information, including:
- Domainname.
- IP address of thePrimary DNS Serverand theSecondary DNS Server.
- NTP Server AddressandAuthentication Typeof thePrimary NTP Serverand theSecondary NTP Server. TheAuthentication Typeoptions areNone,Symmetric Key, andAutoKey.
- Configure general cluster settings.Many settings are pre-populated with either defaults, information from previously existing settings on the controller node, or the settings you just configured.
- Select the new cluster >General.
- (Optional)Enable DNSfor the controller node to advertise the service status using DNS protocol. The cluster controller provides DNS services on the management (MGT) interface port.
- Register Firewall Tothe use the service advertised by the cluster controller(s). Palo Alto Networks recommends adding both controllers as authority servers as this provides the benefit of high-availability. Use the form:wfpc.service.<cluster-name>.<domain>For example, a cluster named mycluster in the paloaltonetworks.com domain would have the domain name:wfpc.service.mycluster.paloaltonetworks.com
- Enter theContent Update Serverfor the cluster. Use the defaultupdates.paloaltonetworks.comFQDN to connect to the closest server.Check Server Identityto confirm the update server identity by matching the common name (CN) in the certificate with the IP address or FQDN of the server (this is checked by default).
- (Optional) Enter the publicWildFire Cloud Serverlocation or use the defaultwildfire.paloaltonetworks.comso that the cluster (or standalone appliance managed by Panorama) can send information to the closest WildFire cloud server. If you leave this field blank and do not connect to a WildFire cloud server, the cluster can’t receive signature updates directly from the WildFire public cloud, and can’t send samples for analysis or contribute data to the public cloud.
- If you connect the cluster to the public WildFire cloud, select the cloud services you want to enable:
- Send Analysis Data—Send an XML report about local malware analysis. If you send the actual samples, the cluster doesn’t send reports.
- Send Malicious Samples—Send malware samples.
- Send Diagnostics—Send diagnostic data.
- Verdict Lookup—Automatically query the WildFire public cloud for verdicts before performing local analysis to reduce the load on the local WildFire appliance cluster.
- Select theSample Analysis Imageto use, based on the types of samples the cluster will analyze.
- Configure the amount of time for the cluster to retainBenign/Graywaresample data (1-90 day range, 14 day default) andMalicioussample data (minimum 1 day, no maximum (indefinite), default is indefinite). Malicious sample data includes phishing verdicts.
- (Optional) SelectPreferred Analysis Environmentto allocate more resources toExecutablesorDocuments, depending on your environment. TheDefaultallocation is balanced betweenExecutablesandDocuments. The available resource amount depends on the number of WildFire nodes in the cluster.
- Check to ensure that the primary and backup Panorama servers are configured.If you did not configure a backup Panorama server and want to do so, you can add the backup Panorama server.
- Select the cluster.
- SelectAppliance.
- Check (or enter) the IP address or FQDN of the primaryPanorama Serverand of the backupPanorama Server 2if you are using a high availability configuration for centralized cluster management.
- (Optional) Configure system and configuration log settings for the cluster, including log forwarding.
- Select the cluster.
- SelectLogging.
- SelectSystemorConfigurationto configure a system or configuration log, respectively. The process for configuring them is similar.
- Add(
) and
Namethe log forwarding instance, select theFilter, and configure theForward Method(SNMP,Email,Syslog, orHTTP).
- Configure administrator authentication.
- Select the cluster.
- SelectAuthentication.
- Select theAuthentication Profile, eitherNoneorradius. RADIUS is the only supported external authentication method.
- Set theLocal Authenticationmode for admin users as eitherPasswordorPassword Hash, and enter thePassword.
- Commit the configuration on the Panorama appliance and push it to the cluster.
- Commit and Push.
- If there are configurations on the Panorama appliance that you do not want to push,Edit Selectionsto choose the appliances to which you push configurations. The pushed configuration overwrites the running configuration on the cluster nodes so that all cluster nodes run the same configuration.
Recommended For You
Recommended Videos
Recommended videos not found.