Configure General Cluster Settings on Panorama

Configure settings for the WildFire appliance cluster nodes.
Many settings are pre-populated with either defaults, information from previously existing settings on the controller node, or the settings you just configured.
Select the cluster.
Select
Appliance
.
Enter new information, keep the pre-populated information from the cluster controller node, or edit the pre-populated information, including:
Domain
name.
IP address of the
Primary DNS Server
and the
Secondary DNS Server
.
NTP Server Address
and
Authentication Type
of the
Primary NTP Server
and the
Secondary NTP Server
. The
Authentication Type
options are
None
,
Symmetric Key
, and
AutoKey
.
Configure general cluster settings.
Many settings are pre-populated with either defaults, information from previously existing settings on the controller node, or the settings you just configured.
Select the new cluster >
General
.
(
Optional
)
Enable DNS
for the controller node to advertise the service status using DNS protocol. The cluster controller provides DNS services on the management (MGT) interface port.
Register Firewall To
the use the service advertised by the cluster controller(s). Palo Alto Networks recommends adding both controllers as authority servers as this provides the benefit of high-availability. Use the form:
wfpc.service.<cluster-name>.<domain>
For example, a cluster named
mycluster
in the
paloaltonetworks.com
domain would have the domain name:
wfpc.service.mycluster.paloaltonetworks.com
Enter the
Content Update Server
for the cluster. Use the default
updates.paloaltonetworks.com
FQDN to connect to the closest server.
Check Server Identity
to confirm the update server identity by matching the common name (CN) in the certificate with the IP address or FQDN of the server (this is checked by default).
(
Optional
) Enter the public
WildFire Cloud Server
location or use the default
wildfire.paloaltonetworks.com
so that the cluster (or standalone appliance managed by Panorama) can send information to the closest WildFire cloud server. If you leave this field blank and do not connect to a WildFire cloud server, the cluster can’t receive signature updates directly from the WildFire public cloud, and can’t send samples for analysis or contribute data to the public cloud.
If you connect the cluster to the public WildFire cloud, select the cloud services you want to enable:
Send Analysis Data
—Send an XML report about local malware analysis. If you send the actual samples, the cluster doesn’t send reports.
Send Malicious Samples
—Send malware samples.
Send Diagnostics
—Send diagnostic data.
Verdict Lookup
—Automatically query the WildFire public cloud for verdicts before performing local analysis to reduce the load on the local WildFire appliance cluster.
Select the
Sample Analysis Image
to use, based on the types of samples the cluster will analyze.
Configure the amount of time for the cluster to retain
Benign/Grayware
sample data (1-90 day range, 14 day default) and
Malicious
sample data (minimum 1 day, no maximum (indefinite), default is indefinite). Malicious sample data includes phishing verdicts.
(
Optional
) Select
Preferred Analysis Environment
to allocate more resources to
Executables
or
Documents
, depending on your environment. The
Default
allocation is balanced between
Executables
and
Documents
. The available resource amount depends on the number of WildFire nodes in the cluster.
Check to ensure that the primary and backup Panorama servers are configured.
If you did not configure a backup Panorama server and want to do so, you can add the backup Panorama server.
Select the cluster.
Select
Appliance
.
Check (or enter) the IP address or FQDN of the primary
Panorama Server
and of the backup
Panorama Server 2
if you are using a high availability configuration for centralized cluster management.
(
Optional
) Configure system and configuration log settings for the cluster, including log forwarding.
Select the cluster.
Select
Logging
.
Select
System
or
Configuration
to configure a system or configuration log, respectively. The process for configuring them is similar.
Add
( ) and
Name
the log forwarding instance, select the
Filter
, and configure the
Forward Method
(
SNMP
,
Email
,
Syslog
, or
HTTP
).
Configure administrator authentication.
Select the cluster.
Select
Authentication
.
Select the
Authentication Profile
, either
None
or
radius
. RADIUS is the only supported external authentication method.
Set the
Local Authentication
mode for admin users as either
Password
or
Password Hash
, and enter the
Password
.
Commit the configuration on the Panorama appliance and push it to the cluster.
Commit and Push
.
If there are configurations on the Panorama appliance that you do not want to push,
Edit Selections
to choose the appliances to which you push configurations. The pushed configuration overwrites the running configuration on the cluster nodes so that all cluster nodes run the same configuration.