topic Re: Pan-agent how to set an agent as primary in General Topics

Pan-agent how to set an agent as primary

novidys — Thu, 09 Dec 2010 20:17:00 GMT

Hi,

I installed about pan 12 agents to retrieve a Domain and they all communicate with a PAN.

The PAN OS is 3.1.5

As I saw in another post, only one agent send information (IP/user) to the PAN, it is the primary agent.

My problem: this agent does not send all the information. When the primary agent was the one on the main AD server it was working fine. But since a reboot of this server, the primary agent.

How can I force an agent to be the primary? or why I don't get all the IP/user information ?

Thanks,

Re: Pan-agent how to set an agent as primary

drogers — Fri, 10 Dec 2010 01:44:27 GMT

IP/User information should be pushed to the firewall from each agent you have configured. The primary/secondary change recently related to the DC that the agents pulled user/group mapping from.

If you're not getting IP info from one of your agents, check the following output from the CLI - it should show each configured agent and it's status.

show user pan-agent statistics

Re: Pan-agent how to set an agent as primary

novidys — Fri, 10 Dec 2010 08:24:10 GMT

Thanks,

But, all of the agents are connected (and status ok) with the command "show user pan-agent statistics".

I also try "debug device-server reset pan-agent all" but it doesn't change anything.

When I execute the command show user ip-user-mapping, a lot of IP address have the second and third column as "Unknown". And only IP of the network of the primary agent have these columns with a value (AD and user).

When we look on one agent in a DC, we have no errors in the "Agent status" field, and we success to get all the mapping IP/user with a "get all" button in "IP to Username information" section.

Re: Pan-agent how to set an agent as primary

novidys — Fri, 10 Dec 2010 14:17:26 GMT

I got a response from support.

The issue is known as a bug and may be fix in 3.1.7.

To get all agent sending information, we can execute the command: debug software restart device-server

Bye,