Configure General Cluster Settings on Panorama

Some general settings are optional and some general settings are pre-populated with default values. It’s best to at least check these settings to ensure that the cluster configuration matches your needs. General settings include:
  • Connecting to the WildFire public cloud and submitting samples to the public cloud.
  • Configuring data retention policies.
  • Configuring logging.
  • Setting the analysis environment (the VM image that best matches your environment) and customizing the analysis environment to best service the types of samples the firewalls submit to WildFire.
  • Set IP addresses for the DNS server, NTP server, and more.
  1. Configure settings for the WildFire appliance cluster nodes.
    Many settings are pre-populated with either defaults, information from previously existing settings on the controller node, or the settings you just configured.
    1. Select the cluster.
    2. Select
      Appliance
      .
    3. Enter new information, keep the pre-populated information from the cluster controller node, or edit the pre-populated information, including:
      • Domain
        name.
      • IP address of the
        Primary DNS Server
        and the
        Secondary DNS Server
        .
      • NTP Server Address
        and
        Authentication Type
        of the
        Primary NTP Server
        and the
        Secondary NTP Server
        . The
        Authentication Type
        options are
        None
        ,
        Symmetric Key
        , and
        AutoKey
        .
  2. Configure general cluster settings.
    Many settings are pre-populated with either defaults, information from previously existing settings on the controller node, or the settings you just configured.
    1. Select the new cluster >
      General
      .
    2. (
      Optional
      )
      Enable DNS
      for the controller node to advertise the service status using DNS protocol. The cluster controller provides DNS services on the management (MGT) interface port.
    3. Register Firewall To
      the use the service advertised by the cluster controller(s). Palo Alto Networks recommends adding both controllers as authority servers as this provides the benefit of high-availability. Use the form:
      wfpc.service.<cluster-name>.<domain>
      For example, a cluster named
      mycluster
      in the
      paloaltonetworks.com
      domain would have the domain name:
      wfpc.service.mycluster.paloaltonetworks.com
    4. Enter the
      Content Update Server
      for the cluster. Use the default
      updates.paloaltonetworks.com
      FQDN to connect to the closest server.
      Check Server Identity
      to confirm the update server identity by matching the common name (CN) in the certificate with the IP address or FQDN of the server (this is checked by default).
    5. (
      Optional
      ) Enter the public
      WildFire Cloud Server
      location or use the default
      wildfire.paloaltonetworks.com
      so that the cluster (or standalone appliance managed by Panorama) can send information to the closest WildFire cloud server. If you leave this field blank and do not connect to a WildFire cloud server, the cluster can’t receive signature updates directly from the WildFire public cloud, and can’t send samples for analysis or contribute data to the public cloud.
    6. If you connect the cluster to the public WildFire cloud, select the cloud services you want to enable:
      • Send Analysis Data
        —Send an XML report about local malware analysis. If you send the actual samples, the cluster doesn’t send reports.
      • Send Malicious Samples
        —Send malware samples.
      • Send Diagnostics
        —Send diagnostic data.
      • Verdict Lookup
        —Automatically query the WildFire public cloud for verdicts before performing local analysis to reduce the load on the local WildFire appliance cluster.
    7. Select the
      Sample Analysis Image
      to use, based on the types of samples the cluster will analyze.
    8. Configure the amount of time for the cluster to retain
      Benign/Grayware
      sample data (1-90 day range, 14 day default) and
      Malicious
      sample data (minimum 1 day, no maximum (indefinite), default is indefinite). Malicious sample data includes phishing verdicts.
    9. (
      Optional
      ) Select
      Preferred Analysis Environment
      to allocate more resources to
      Executables
      or
      Documents
      , depending on your environment. The
      Default
      allocation is balanced between
      Executables
      and
      Documents
      . The available resource amount depends on the number of WildFire nodes in the cluster.
  3. Check to ensure that the primary and backup Panorama servers are configured.
    If you did not configure a backup Panorama server and want to do so, you can add the backup Panorama server.
    1. Select the cluster.
    2. Select
      Appliance
      .
    3. Check (or enter) the IP address or FQDN of the primary
      Panorama Server
      and of the backup
      Panorama Server 2
      if you are using a high availability configuration for centralized cluster management.
  4. (
    Optional
    ) Configure system and configuration log settings for the cluster, including log forwarding.
    1. Select the cluster.
    2. Select
      Logging
      .
    3. Select
      System
      or
      Configuration
      to configure a system or configuration log, respectively. The process for configuring them is similar.
    4. Add
      ( add_icon.png ) and
      Name
      the log forwarding instance, select the
      Filter
      , and configure the
      Forward Method
      (
      SNMP
      ,
      Email
      ,
      Syslog
      , or
      HTTP
      ).
  5. Configure administrator authentication.
    1. Select the cluster.
    2. Select
      Authentication
      .
    3. Select the
      Authentication Profile
      , either
      None
      or
      radius
      . RADIUS is the only supported external authentication method.
    4. Set the
      Local Authentication
      mode for admin users as either
      Password
      or
      Password Hash
      , and enter the
      Password
      .
  6. Commit the configuration on the Panorama appliance and push it to the cluster.
    1. Commit and Push
      .
    2. If there are configurations on the Panorama appliance that you do not want to push,
      Edit Selections
      to choose the appliances to which you push configurations. The pushed configuration overwrites the running configuration on the cluster nodes so that all cluster nodes run the same configuration.

Related Documentation