topic Palo-Alto network user-ID agent set-up in Next-Generation Firewall Discussions

Palo-Alto network user-ID agent set-up

Sujanya — Fri, 25 Nov 2022 06:02:11 GMT

I am configuring user-id agent in firewall. So created some Kerberos profile and called in user-ID agent set-up of user mapping and push the changes to firewall.

All the configurations were pushed ( server monitoring, Kerberos profile) except user-ID agent set-up filed. It is not giving the option for me even to manually configure the same set-up.

Note : These configurations are in global template and I am pushing the template stack for the firewalls ( where priority is for Global and later for device templates)

Kindly help me on the same.

Re: Palo-Alto network user-ID agent set-up

PavelK — Fri, 25 Nov 2022 08:12:27 GMT

Hello @Sujanya

did it failed while pushing to Firewall? If it is so, it would be helpful to share the details of the error?

Kind Regards

Pavel

Re: Palo-Alto network user-ID agent set-up

Sujanya — Fri, 25 Nov 2022 08:18:21 GMT

Hi Pavel,

Thanks for responding. No I didn't failed. The configurations were pushing without any issues. All these tabs ( server monitoring, Kerberos profile) are visible with required config in GUI. But "Palo-Alto network user-ID agent set-up" is showing empty in GUI.

For my surprise , When i taken the xml output ( backup-file ) of the firewall and reviewed the configurations, it is visible there.

Re: Palo-Alto network user-ID agent set-up

PavelK — Fri, 25 Nov 2022 08:32:06 GMT

Thank you for reply @Sujanya

could you confirm PAN-OS version of Panorama and Firewall you are pushing this configuration to?

Kind Regards

Pavel

Re: Palo-Alto network user-ID agent set-up

Sujanya — Fri, 25 Nov 2022 08:33:30 GMT

Hi Pavel,

Both Panorama and palo-Alto version is 10.2.2-h2.

Re: Palo-Alto network user-ID agent set-up

PavelK — Fri, 25 Nov 2022 10:03:06 GMT

Thank you for reply @Sujanya

the closest issue I could find that re-assembles to what you described is a bug: PAN-189894 addressed in PAN-OS 10.2.3:

Kind Regards

Pavel

Re: Palo-Alto network user-ID agent set-up

Sujanya — Fri, 02 Dec 2022 11:32:25 GMT

Hi PavelK,
This is the error I am getting when I tried it to configure manually. But to override it there is no template symbol is showing near the user-id-agent set-up tab.

Re: Palo-Alto network user-ID agent set-up

PavelK — Tue, 06 Dec 2022 05:02:50 GMT

Thank you for reply @Sujanya

to be honest, based on description of the issue, this looks like a bug. I would upgrade Panorama to 10.2.3 which is as of now recommended version.

Kind Regards

Pavel

Re: Palo-Alto network user-ID agent set-up

Sujanya — Fri, 24 Mar 2023 09:49:02 GMT

Hi @PavelK ,

I upgraded the Palo-Alto to 10.2.3 version, and now Kerberos profile issue has been resolved. But I still I can see server monitoring status is not showing as connected.