topic Re: USE IDENTIFICATION WITH 100 PAN AGENT in General Topics

USE IDENTIFICATION WITH 100 PAN AGENT

alle — Wed, 18 Apr 2012 13:34:57 GMT

Hello,

I must use 100 PAN AGENT (limit of product) for a project. Someone have already test to use 100 pan-agent ( 25 by VSYS*5)?

do you know if the Palo alto (PA5060) work fine with this number of pan-agent.

regards,

ALLE

Re: USE IDENTIFICATION WITH 100 PAN AGENT

mikand — Wed, 18 Apr 2012 19:31:06 GMT

Sorry I havent tested that many but what kind of limit is forcing you do to this?

Re: USE IDENTIFICATION WITH 100 PAN AGENT

alle — Thu, 19 Apr 2012 09:03:48 GMT

Mikhand

because you can't have a shared pan agent when you use VSYS!!.

So if you have 10 vsys and you have 5 site with ACTIVE DIRECTORY and you want do HA on each SITE :

10VSYS*(5 panagent*2(HA))= 100 pan agent

and I can't use an another architecture. (I have already discuss of this problem with Palo Alto)

I just need to know if someone have already try to use 100 PAN AGENT

Re: USE IDENTIFICATION WITH 100 PAN AGENT

mikand — Thu, 19 Apr 2012 09:48:14 GMT

And I guess it wont work if two different VSYS (or for that matter two different PA devices) use the same panagent?

Because (if we ignore redundancy for a short moment) one pan-agent per site will serve whatever this site has in its directory. Then no matter if you use 10 VSYS or 10 PA devices I think they should be able to speak to the same pan-agent (since the pan-agent is just a proxy between how PA wants the information and how the AD (or whatever) can present it).

Or is a pan-agent limited to only serve a single PA device (or VSYS) at a time?

Re: USE IDENTIFICATION WITH 100 PAN AGENT

ucteam — Wed, 25 Apr 2012 09:36:32 GMT

Yes I've successfully conected 100 UserID agents. All back to a single vsys.

I've also requested that PA have the 100 UserID agent limit increased and the max DC's limit... as the limits seems arbitrary and unnecessarily restricts design options for large networks.

Re: USE IDENTIFICATION WITH 100 PAN AGENT

alle — Thu, 10 May 2012 14:40:25 GMT

OK I Confirm that PA can support 100 PAN AGENT

thks,