auto-tagging registration on remote user-id agent

[ppk_vs]

Hello colleagues,

did someone manage to use dynamic tag registration on the remote user-id agent? I cannot find any explanation in documentation or community discussions. It is written in the manual that need to create a http profile

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/forward-logs-to-an-https-destin...

So, first of all, there should be some login/password - what is this login, where is it configured on the user-id agent?

The port in the example is 443. But we don't have any service running on the 443 on the servers with user-id agent. Should it be the same port on which the paloalto firewall connects, 5007?

 What should be done with a certificate on the user-id agent, do I need to generate some?

Thanks in advance for any working example.

[SCantwell_IM]

In order to use tagging, you need to use a "built in" action from the Log Fwding profile.

When a security policy is hit, the traffic is logged to a log fwding profile, that has a built in action.

The built in action will apply your tag dynamically.

I am not sure how to apply a log to a remote user agent.  That piece of software is for identifying users.

Not sure where/how this come into use.

Can you provide your use case?

[ppk_vs]

Hello Steve,

yes, correct, there is a built-in action, and in this built-in action we have a mandatory field - registration, we we can choose from three options: Local User-ID, Panorama User-ID, Remote User-ID.

  We don't have panorama, and we don't have local user-id on the firewall, so, I guess, the only option is to use remote User-ID?