Proper User-ID Configuration

marwankhaled — Tue, 14 Oct 2025 12:09:53 GMT

We have 4 Palo Alto Clusters managed by panorama, each cluster has 2 firewalls, each firewall has number of Vsys.

We want to configure user-ID with the Agent based method.

My proposed solution is to integrate each Firewall directly with the User-ID agent then push User-ID agents in panorama (In device group setup it asks about default firewall to get user-id data from and it is set correctly)

Is this solution needs special configuration between the panorama and the firewalls rather than mentioned earlier in the device group setup?

After this implementation, will I be able to configure firewall policies from Panorama and push them to Firewalls based on user-id data collected from the firewalls right ?

Re: Proper User-ID Configuration

reaper — Thu, 16 Oct 2025 10:47:01 GMT

it depends where your userID information comes from how you should design redistribution

If any of your firewalls serve up globalprotect, you should set them as a source as well. most efficiently it would probably be to set up a hub-spoke model with panorama collecting and redistributing all user-id information

if your user-id information only comes from your AD/user-id agent, you can connect all firewalls directly to user-id agent

topic Re: Proper User-ID Configuration in General Topics

Proper User-ID Configuration

Re: Proper User-ID Configuration