topic Re: User-ID for large scale deployment in General Topics

User-ID for large scale deployment

nkmehta — Tue, 08 Jun 2021 06:54:57 GMT

Hi,

We have planned to implement user based policy in PA and we have roughly around 5k users across different locations with multiple controller as we have two options,

1. Dedicated windows based user-id agent

2. Palo alto Integrated user-id agent

among these two which one is best for production with 5K+ users and what is best practice for deploying the same

Regards,

Siva

Re: User-ID for large scale deployment

Mick_Ball — Tue, 08 Jun 2021 15:48:17 GMT

do you have DC's at each of these sites... there are various figures flying around but you need to consider what is at each location. if you have a palo at each location then use local agent to local DC. we have 8 DC's for 8 k user base and we just went for 1 server agent at each of our 2 major sites on dedicated windoze boxes and never had any issues. we do have 200 remote small sites but they all stream back to our major sites.

perhaps an overview of your setup would help....

this kinda keeps the busy end away from the palo's and the DC's

Re: User-ID for large scale deployment

nikoolayy1 — Wed, 09 Jun 2021 07:10:58 GMT

To not have much load on the firewalls the Dedicated windows based user-id agent is better than the integrated one.

Also you can use user redistribution so that the firewalls that are not infront of the users will get this data from the other edge firewalls if they can't directly connect to the windows agent. You can read this if interested:

https://live.paloaltonetworks.com/t5/general-topics/ip-and-user-tag-mappings-redistribution-for-dag-dug/m-p/393030#M90970