topic PanOS 5.0 User-ID Redistribution in General Topics

PanOS 5.0 User-ID Redistribution

BrutalDismount — Wed, 19 Dec 2012 21:58:20 GMT

So a new feature within 5.0 is to allow a PA to act as a user-id redistribution point for other PA's. Has anyone gotten this to work? I tried testing this out, but I am not seeing how to configure.

I setup our core PA's to act as a redistribution point using a collector name and shared key.

I then tried configuring one of my remote PA's to connect to this collector, however it is requiring me to enter a port. Not sure what port to use.

There is no place to set the port on the redistribution point side, unless there is a default I am not aware of.

Re: PanOS 5.0 User-ID Redistribution

hotpotato — Thu, 20 Dec 2012 01:55:24 GMT

One page 283 of the PAN 5.0 admin guide,

---------

When using a PAN-OS firewall as a redistribution point for user mapping

information and you configure the User-ID Agent to connect to that

device, you must use port 5007.

-------

Re: PanOS 5.0 User-ID Redistribution

lwheelock — Thu, 31 Jan 2013 22:14:13 GMT

The document is somewhat misleading in that it's suggesting you use an interface dedicated for traffic to bind your user-id service to. This may not always be desirable. Alternatively, if you wish to use the management interface as the agent you can configure this under Setup - > Management -> Management Interface Settings and checking the box next to Userid in 'Services'.