topic Re: best practice User-ID strategy? in General Topics

best practice User-ID strategy?

LCMember17002 — Fri, 08 Nov 2013 10:12:40 GMT

Hello,

first I try to give you some information. Our headquarter is located in Germany. All of our subsidiaries are connected to Germany via relatively slow VPN lines. Overall we have round about 20 DCs in different countires. Until now we have only 3 Palo Alto firewalls (Germany, USA, Canada) but in the future we plan to buy more.

Our setup until last week was the following. We installed the software User-ID agent on the DC in Germany. We connected all DCs worldwide to this agent. Unfortunately the agent retrieves all logs and produces a lot of traffic over the VPN lines. So we decided to change our setup.

We are planning to install the User-ID agent on all DCs worldwide and connect the firewall in Germany with all agents. With this solution the traffic should drop significantely. Furthermore the firewall in USA and Canada will be connected with the particular DC in that country and in Germany.

Or is it better to connect these firewalls also with all agents?

Is it possible to distribute the mappings from the firewall in Germany to the other firewalls without the need of connecting agents to the firewalls in USA and Canada?

Another question is if all agents should observe all available networks or only the local subnets?

I hope you can help me!

Re: best practice User-ID strategy?

Retired Member — Sun, 10 Nov 2013 19:02:01 GMT

Hi,

"We are planning to install the User-ID agent on all DCs worldwide and connect the firewall in Germany with all agents. With this solution the traffic should drop significantely."

Yes this will be fine.Also in the agents you may change 1second predefined read logs to 2(or 3) seconds.

Redistribute users is only available for agentless user-id.

to observer all available networks will be fine.

Re: best practice User-ID strategy?

mbutt — Tue, 12 Nov 2013 00:37:55 GMT

Here are few good docs regarding the deployment of User id.

https://live.paloaltonetworks.com/docs/DOC-3120

https://live.paloaltonetworks.com/docs/DOC-5939

Hope this helps.
Thanks

Numan

Re: best practice User-ID strategy?

LCMember17002 — Wed, 04 Dec 2013 07:11:06 GMT

Currently we have 20 User-ID agents connected to our PA-2050. In the last days we had severe problems with our Palo Alto. The CPU was on full load and we were not able to login on CLI or the webinterface. The only solution was to restart the firewall. A few weeks ago we had the same problems but not as many as these days.

I'm not sure but something tells me that the integration of the User-ID agents is the cause of our problems. Is this possible?

The useridd process consumes a lot of memory. Is this normal?

Re: best practice User-ID strategy?

JimS2 — Sat, 14 Dec 2013 16:41:09 GMT

What PANOS and User ID Agent version are you running?

Re: best practice User-ID strategy?

LCMember17002 — Sun, 22 Dec 2013 16:25:20 GMT

All the latest. PANOS 5.09 and User-ID Agent 5.0.6-6.

Re: best practice User-ID strategy?

JimS2 — Sun, 22 Dec 2013 17:51:55 GMT

The memory and cpu usage in the screen shot is not all that high. I would be more interested in the memory and cpu usage on the mgmtsrvr and devsrvr.

Run: show system resources follow

Use Shift + m

Re: best practice User-ID strategy?

LCMember17002 — Mon, 23 Dec 2013 07:51:10 GMT

How many User-ID Agents can usally be connected to a PA-2050 without problems?

Here another screenshot mit Shift + M.

Re: best practice User-ID strategy?

Phoenix — Mon, 23 Dec 2013 16:07:00 GMT

Hello admin@peri

Per PanOS 4.1 and 5.0, 2050 supports 100 User ID agents.

Though it can support so many agents I would suggest the efficiency of the hardware with user id agents depends on the frequency of the data being retrieved from the agents to the firewall and how much data is being obtained. To some extent we can change the frequency values on the user id agents to retrieve user-ip mapping.

Hope this answers your question !

Re: best practice User-ID strategy?

JimS2 — Mon, 23 Dec 2013 18:14:33 GMT

The mgmtsrvr server memory is border line but not extreme by any means. I would open a support case for the performance issue when it occurs again. This will need to be diagnosed live by a technician.

Re: best practice User-ID strategy?

hshah — Thu, 26 Dec 2013 00:14:01 GMT

Hello admin@peri,

Normally only local subnet.....

Because User based policies are normally configured inside to outside direction.

But if User based policy is configured for outside to inside network then its required to learn all the networks.

Let me know if that answers the question.

Regards,

Hardik Shah