topic User-ID agent upgrade path in General Topics

User-ID agent upgrade path

Reece.Boucher — Tue, 22 Oct 2024 22:18:02 GMT

Greetings,

I am running NGFW x 35 (10.2.10-h3) and User-ID Agent 10.2.2-111, which I believe needs to be upgraded to avoid the Nov-18 issue.

My question is, does the User-ID Agent need to remain in the same stream as NGFW (ie. 10.2.x) or can it go to the 11.0 stream?

A side question (because I inherited this environment) ...

If I have the 'standard' User-ID agent installed can I do a clean upgrade of the #UaCredInstall version over the top? Is there any additional configuration required

Re: User-ID agent upgrade path

arusharma — Wed, 23 Oct 2024 12:42:24 GMT

Install the User-ID agent version that is the same as the PAN-OS version running on the firewalls. If there is not a User-ID agent version that matches the PAN-OS version, install the latest version that is closest to the PAN-OS version.

Step 3: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-mapping-using-the-windows-user-id-agent/install-the-windows-based-user-id-agent

You can do clean and over the top both make sure it happens in a maintenance window.

Re: User-ID agent upgrade path

CosminM — Wed, 23 Oct 2024 15:37:43 GMT

Hello @Reece.Boucher

If you are running on your firewalls PAN-OS 10.2.10-h3 and your User-ID Agent version is 10.2.2-111, then you don't need to do any upgrade or hotfix installation to mitigate Nov 18 certificate issue.

You can see the minimum required versions on Table 1 here: https://live.paloaltonetworks.com/t5/customer-advisories/update-to-additional-pan-os-certificate-expirations-and-new/ta-p/572158#Table1 .