topic Re: User-id redistribution not working in General Topics

User-id redistribution not working

ASHARMA45 — Fri, 26 Mar 2021 23:10:32 GMT

I have user-id successfully configured on a fw, and i am trying to redistribute these mappings to panorama

We are using the integrated Panos agent,

i have created the the user-id collector name/pre-shared key on redistribution tab of the User-id Agent Setup; and configured those credentials on the Panorama's User-ID agents tab, via port 5007

But I am not getting a successful connection

Performing a tcpdump on the mgnt interface of the firewall, i can see traffic from the panorama but no traffic going back

From the Panorama useridd.log i see, but I dont anything in the fw log

2021-03-26 23:41:15.902 -0700 Error: pan_ssl_conn_open(pan_ssl_utils.c:755): pan_tcp_sock_open()

Can anyone help ?

Re: User-id redistribution not working

nikoolayy1 — Sun, 28 Mar 2021 12:34:10 GMT

Probably you are using a tcpdump on the firewall to see that it is not responding to USER-ID requests from the Panoema?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleECAS

If so then check on the firewall if Network Connectiviy services for the managment interface if USER-ID is enabled also check the

Service Route Configuration as maybe the firewall is sending the user-id info on another interface.

https://live.paloaltonetworks.com/t5/best-practice-assessment-device/management-interface-settings-network-connectivity-services/ta-p/336948

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGJCA0