topic User-ID limitations for distribution in General Topics

User-ID limitations for distribution

ssavariau — Mon, 21 Mar 2022 06:42:11 GMT

Hi folks !

Would like your advice on a specific issue about user-id limitations :

One of our customer is using one central firewall to redistribute user-id mapping to more than 100 devices, and has issues about user-id process crashing on the central fw.

As far as i understood limitations on user-id redistribution, there is a limit of 100 redistribution points beneath each firewall, which is not the case, as this central fw is retrieving infos from 2 user-id agents only. It just spreads these infos to more than one hundred devices. Each remote device only has like 3 layers beneath it.

So, is this normal behavior, or is there a trick here to make it work ?

Subsidiary question, the windows user-id agent sometimes generates more than 150gb of traffic in a day (1gb maximum in normal times), if anyone has an idea 😉

Thx !

Re: User-ID limitations for distribution

kiwi — Thu, 24 Mar 2022 09:05:48 GMT

Hi @ssavariau ,

What hardware are you running and what PAN-OS version ?

Have you checked the firewall logs for a root cause of the UID crashing ? Are there any core-files that can be analyzed ?

Cheers,

-Kiwi.

Re: User-ID limitations for distribution

ssavariau — Thu, 24 Mar 2022 09:35:50 GMT

Hi Kiwi,

Firewalls are a 3220 for the hub, and 220s for spoke, running on PAN-OS 9.0.0

On the hub, distributord process was shown as running, but we still had to run CLI command "debug software restart process distributord" to make it functional again. At the time of this crash, an investigation was done, and that was the immediate solution found to correct it.

If we cannot spread user-id mapping to more than 100 devices from only one, we'll need to take a more hierarchical approach i think ?

Thx for your time !

Cheers

Re: User-ID limitations for distribution

BPry — Fri, 25 Mar 2022 00:49:50 GMT

@ssavariau,

9.0 just went end of life at the beginning of this month, so you'll need to get these to 9.1 or higher sooner rather than later. If you choose to open a chase on the issue, they'll tell you to upgrade before continuing to troubleshoot I'm sure so be aware of that. If you upgrade to a supported release and run into the issue again, then you can open a TAC case and have them identify root cause on why the process locked up, it could easily be some bug in the process you're running into.