topic Re: User-ID Agent AD Group Limitation? in General Topics

User-ID Agent AD Group Limitation?

steveo — Mon, 09 Apr 2012 17:12:17 GMT

All,

Digging around in the various docs I've found I can't seem to find an answer to this question so I'll ask here..

I'm curious if there is a limit on the number of AD groups per user that the Agent can handle? I'm worried we might run into some limitation cause our group situation is really out of control with no fix in sight..

Thanks!

-Steve

Re: User-ID Agent AD Group Limitation?

sjamaluddin — Wed, 11 Apr 2012 23:48:09 GMT

There is no known limit for the number of groups a user can belong to. However, if the user belongs to multiple groups and they are each referenced in the same policy etc. the user will be pulled from the first group the system finds them in. Read top down

There may be delay issues when reading multiple groups or multi tiered/ nested groups because the responss are expected within a certain amount of time - though in principal there is no limit to the number of groups a user may belong to

Re: User-ID Agent AD Group Limitation?

acamacho — Thu, 12 Apr 2012 01:34:59 GMT

repeating what sjamaluddin stated there is no known limit for the number of groups a user can belong to.

Here is a paltform capacity for User ID Agent

Maximum number of pan-agents per vsys: 100

Maximum number of pan-agents per platform: 100

Maximum number of groups that can be defined in policies per vsys: 640

If you need additonal informaiton please contact support or local SE for additional information.

Re: User-ID Agent AD Group Limitation?

steveo — Thu, 12 Apr 2012 16:00:49 GMT

Ok, good things to know!

Thanks!

-Steve