topic Re: UserID Agent version compatbility in General Topics

UserID Agent version compatbility

securehops — Fri, 27 Sep 2024 23:25:58 GMT

Hello,

I'm currently working through the Certificate Advisory. We currently have firewalls running 10.1.11, user-ID agent is 10.1.1-102. Started an upgraded firewalls to current preferred version of 10.1.13h1. The issue I have is I am simultaneously trying to introduce PA-1410 firewalls into Panorama for management. PA-1410 does not support 10.x

The advisory states that firewalls must be upgraded with hotfix before upgrading the UserID agent. Per the advisory:
"Install the hotfix listed in Table 2 below on all NGFWs and Panoramas. It is important to perform this step before updating the agents; these two steps must be performed in sequence"

This creates a challenge, as to my knowledge, UserID agent 10.1.x will not work on firewalls running 11.x. 11.x is my only option for the 1410's and I need to deploy these firewalls well before the other firewalls will be finished upgrading.

What's the best way to go about this? Only thing I can think of is introduce the 1410's without using userID agent temporarily and use agentless server monitor instead. Anyone have another idea?

Also, the latest userID agent is listed as 11.0.1-104, does this work with PAN-OS 11.1 and 11.2? Documentation states it works on 11.0 and earlier.

Re: UserID Agent version compatbility

JayGolf — Tue, 01 Oct 2024 19:11:56 GMT

Hi @securehops ,

I've shared your post with the Advisory team.

Re: UserID Agent version compatbility

BPry — Wed, 02 Oct 2024 00:27:21 GMT

@securehops,

Simple solution that adds a bit of complexity, but why don't you just spin up another agent with 11.0.1 and only use it for the PA-1410s? I imagine that there's a reason that you aren't using agentless to begin with, so that would keep the benefits of running the agent in this instance. Either option is viable assuming that you can use the agentless setup.

Re: UserID Agent version compatbility

securehops — Wed, 02 Oct 2024 01:10:40 GMT

Hi @BPry

I did consider setting up a new server for UserID agent as a backup option but since it's only temporary, I was thinking agentless would be the easier way to go

I always used agentless but it kept triggering a lot of alerts and at the time, the solution from tac was to just use the UserID agent

The also couldn't get clarity from support if the 11.0 userID agent is compatible with pan-os 11.1 and 11.2. Release notes says it's compatible with 11.0 and earlier

Re: UserID Agent version compatbility

reaper — Fri, 04 Oct 2024 08:05:48 GMT

PAN-OS is backwards compatible with userID versions, so PAN-OS 11.x can work with UserID 10.x

no need for any duplication

reaper@fwl-be(active)> show system info | match sw-version sw-version: 11.1.4-h1 reaper@fwl-be(active)> show system info | match model model: PA-1420 reaper@fwl-be(active)> show user user-id-agent config all | match Product Product Version: 10.1.0 Product Version: 10.1.0 reaper@fwl-be(active)> show user user-id-agent state all | match Status Status : conn:idle Status : conn:idle reapern@fwl-be(active)> show user ip-user-mapping all IP Vsys From User IdleTimeout(s) MaxTimeout(s) --------------------------------------------- ------------------- ------- -------------------------------- -------------- ------------- 10.10.10.5 vsys1 UIA pangurus\reaper 6861 6861

Re: UserID Agent version compatbility

securehops — Tue, 15 Oct 2024 15:13:12 GMT

Thanks @reaper

Since I was in a time crunch, I set up a new server temporarily.

This is good to know for future, but documentation states differently. Palo needs to do a better job on this

Re: UserID Agent version compatbility

KhaleelE — Thu, 06 Mar 2025 09:12:54 GMT

Hi @reaper

how about 11.2 Pan Os? Will it work with user id agent? One of customer recieving below error they are using 11.2:

cannot open security log for DC AS-01 - Access denied

Re: UserID Agent version compatbility

reaper — Wed, 02 Apr 2025 08:59:10 GMT

this means the AD is not configured to allow this action (either the service account for userid agent does not have sufficient privileges, or audit logging is not set up properly)

this is not a compatibility issue

Re: UserID Agent version compatbility

R.Maurya013725 — Fri, 26 Sep 2025 05:25:07 GMT

Hi, current preferred release version is 11.0.3. thanks