Configure the Master Key Strata Cloud Manager

1. Login to Strata Cloud Manager.
2. Select System SettingsDevice Management.

   The Device Management page displays the firewalls.
3. Select the required firewalls, click Deploy Master Key and, edit the Deploy Master Key section.
4. Enter the Current Master Key if one exists.
5. Define a new New Master Key, and then Confirm New Master Key. The key must contain exactly 16 characters.
6. To specify the master key Lifetime, enter the number of Days or Hours after which the key expires.

   Configure a new master key before the current one expires. You can set the lifetime of the master key from 1 to 18,250 days. If the master key expires, the firewall automatically reboots in Maintenance mode. Then, you must reset the NGFW to factory default settings.

   Set the Lifetime to two years or less, depending on how many encryptions the device performs. The more encryptions a device performs, the shorter the Lifetime you should set. The critical consideration is to not run out of unique encryptions before you change the master key. Each master key can provide up to 2³² unique encryptions based on the master key value and the Initialization Vector (IV) value. After 2³² unique encryptions, encryptions repeat (are no longer unique), which is a security risk.

   Set a Time for Reminder value (see next step) for the master key and when the reminder notification occurs, change the master key.
7. Enter a Time for Reminder that specifies the number of Days and Hours before the master key expires when the firewall generates an expiration alarm. The firewall automatically opens the System Alarms dialog to display the alarm.

   Set the reminder so that it gives you plenty of time to configure a new master key before it expires in a scheduled maintenance window. When the Time for Reminder expires and the firewall sends a notification log, change the master key, do not wait for the Lifetime to expire.
8. (Optional) For added security, select whether to use an HSM to encrypt the master key. For details, see Encrypt and Refresh Master Keys Using an HSM.
9. Click Deploy Master Key.