topic User Id Mapping/redistribution both in Strata and on a Windows DC in Strata Cloud Manager

User Id Mapping/redistribution both in Strata and on a Windows DC

T.OluOjo — Tue, 17 Jun 2025 02:49:28 GMT

Does anyone have a step by step guide of setting up a User Id agent on a DC, mapping Ip to users and redistributing this data in Strata Cloud Manager. Currently, the User ID agent is pulling data from the servers and has IP-User entries. However, only mobile users are being mapped in the Firewall logs in Strata.

Also, the user Id agent does not show that it is connected to any devices i.e Prisma/Firewall.

Re: User Id Mapping/redistribution both in Strata and on a Windows DC

ErnestoM — Thu, 14 Aug 2025 13:59:49 GMT

I think this is what you are looking for Manage: Identity Redistribution

Re: User Id Mapping/redistribution both in Strata and on a Windows DC

T.OluOjo — Fri, 15 Aug 2025 00:24:51 GMT

Thank you for the link. Yes, that document indeed helped. I will add the full workflow in this thread for anyone who may also need it.

Re: User Id Mapping/redistribution both in Strata and on a Windows DC

T.OluOjo — Fri, 15 Aug 2025 00:46:23 GMT

The workflow in my SD WAN environment for anyone who may need.

1. Install Windows User-ID agent on server to collect auth logs from DCs/IDPs. See Step-by-Step Palo Alto Windows User-ID Agent Setup Guide [2024] by NetSums on YT Step-by-Step Palo Alto Windows User-ID Agent Setup Guide [2024]

2. Virtual FW required per Palo documentation. Deploy VM VM-Series Deployment Guide. and configure the Windows User-ID agent as a Data Redistribution agent in the PA-VM

3. Ensure Security policies exist on PA VM to allow communication between PA-VM and Windows User-Id agent. (Server end also needed a firewall rule in my case to allow connections on Port 5007). Monitor>>User-ID on PA VM should be populated afterwards.

4. Use existing or create a new SC per Manage Identity. Depending on your end goal, add the PA-VM as a redistribution agent sending to RN or SC nodes.

5. If configured correctly, Device>Data redistribution>>Clients on PA-VM will be populated with the EBGP router address of the SC. Firewall/User-id logs in Strata will also reflect the PA-VM as the Mapping Data Source.

🙂

Re: User Id Mapping/redistribution both in Strata and on a Windows DC

GabrielBryson — Tue, 26 Aug 2025 11:48:34 GMT

HI T.

In all honesty start as soon as possible to use Cloud identity Engine as a replacement, it is so much easier to deploy (free) and manage, and it also uses much fewer firewall and network resources, this can slowly be integrated into your existing environment without causing any disruption as can be run during migration in parallel with legacy User_ID, its really a no brainer and i no longer even consider using User-ID

Re: User Id Mapping/redistribution both in Strata and on a Windows DC

T.OluOjo — Fri, 29 Aug 2025 00:07:16 GMT

Thanks for the recommendation, Gabriel. I will look into the CIE and see how we go with that. If you do have any useful links/docos please feel free to share them. Thanks!