Redistribute Global protect mappings to another FW

[BigPalo]

Hi,

We can not identify GP users in a remote FW. We can see all AD mappings but not GP. I explain the scenario:

INTERNET  ---------------> FW Central (gateway GP) -----> MPLS --------------> Remote FW PALO ALTO

both PA are integrated with LDAP, but not have userid agents.

We can see the AD users in both PA, but when a user is connecting by Global protect, the remote FW Palo Alto can NOT identify the mapping USER/IP.

In FW Central we can see          10.0.0.1 domain/david.james  GP

but in FW remote                       10.0.0.1       uknown unknown

This is normal because GP is only in FW Central, but there is any way to redistribute the GP mapping to the remote FW???

thanks

[santonic]

Yes, you can redistribute User-ID infor between PA firewalls.

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/user-id/deploy-user-id-in-a-large-sc...

[BigPalo]

Yes, but without userid agents? and GP users information?

what config we have to do in the FW which will receive the mappings??? i see that we only configure the FW will send the mappings, but in the fw receiving?

[santonic]

You don't need agents for GP users. PA which terminates GP connections has all the info about these users.

On receiving PA you set the first PA as User-ID agent.

[BigPalo]

Ues, i know its not necessary agents for GP. But a FW can send all GP users info matches to another FWs???? or the FW can only send UIA/AD info to another FW?

[santonic]

It redistributes User-ID info no matter which source it came from (GP, User-ID agent, AD, syslog...)

[Remo · Accepted solution]

---

@santonic wrote:

It redistributes User-ID info no matter which source it came from (GP, User-ID agent, AD, syslog...)

---

The only exception are mappings from Terminal Server agents which cannot be redistributed.