topic Panorama passive device redistributing User-ID mappings? in Panorama Discussions

Panorama passive device redistributing User-ID mappings?

Carracido — Fri, 16 May 2025 11:32:14 GMT

Dear community!

We have configured user-ID redistribution to send mappings to firewalls from Panorama. The same config as the following:

https://www.packetswitch.co.uk/palo-alto-user-id-redistribution/

We have to panoramas in active/passive and some firewalls are having alarms like the following:

Issue description :: Redistribution Agent Panorama2(vsys1): details: close connection to agent.
Severity :: High

That´s is the passive Panorama. I assume that the passive Panorama doesn´t participate in the User-ID redistribution and thus the firewall cannot just connect to its User-ID agent service. Anyone could confirm this? I didn´t find any statement in official resources.

Thank you in advance!

Re: Panorama passive device redistributing User-ID mappings?

nohash4u — Fri, 16 May 2025 16:50:40 GMT

HI @Carracido,

I can confirm similar behaviour with the NGFWs. I wrote a thread on it here: LIVEcommunity - Food for Thought - Data Redistribution during HA Failover - User-ID - LIVEcommunity - 1219823

On a similar thread, recently I moved a configuration towards Panorama being used as the Data Redistribution Agent. I did configure the Data Redistribution Clients (the NGFWs) to connect to the Data Redistribution Agent on Panorama via host and port, however, I am curious if configuring the Data Redistribution Clients (the NGFWs) to connect to the Data Redistribution Agent on Panorama via Serial Number will make a difference. In my case, Panorama was not HA, so the problem does not apply.

Let me know your thoughts!