CIE and Panorama in different CSPs?

[djohnson229]

Hey there, scenario is CIE is in one Palo CSP and Panorama is in a different Palo CSP (the reason why is they are managed by different companies). Should Panorama be able to pull group mappings that exist in CIE, even though the two are in different CSPs?

Thanks

DJ

[reaper]

Panorama will not be able to pull data from that particular CIE. When you create a new CIE link on Panorama, Panorama will connect up to the CSP to fetch all associated CIE instances so you can select which one to connect to (in case there's multiple in your CSP)

you can't connect to a CIE by some sort of identifier at this time

you can spin up a CIE instance and grant the other company access via common services > identity & access

[djohnson229]

Thank you so much for this. So we would "could" spin up a new CIE in CSP#2 and 'pull' the user info from the CIE in CSP#1 - is that right?

I would need to do some research to see what cost is associated with doing this if that is true.