'Redistribution Agent XXX(vsys1): details: close connection to agent

[Tqpharma]

Dear All,

I have installed user-id agent on the server in order to use user-mapping.  it was working but it suddenly stopped working.  I checked the system log it gives me description contains 'Redistribution Agent XXX(vsys1): details: close connection to agent'

I went through the article https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000Cr9GCAS&lang=en_US%E2%80%A...

I run the following command:

2. ping host <IP address of the User-ID Agent>
   it is success

3. ping source <IP address of the dataplane interface> host <IP address of User-ID Agent>
   it is success

4. show netstat numeric-hosts yes numeric-ports yes | match <IP address of the User-ID agent>
   it returns nothing

5. netstat -na | findstr 5007
   netstat -na | findstr <IP address of the ethernet interface connected to the firewall>
   it return nothing.
   
   Any one have an idea about what is going on.

[BPry]

@Tqpharma,

You sure that the service just didn't stop or fail to start properly? 

The fact that netstat -na | findstr 5007 isn't returning anything when you run it on the server would mean that it isn't listening on the default port, which would explain why it dropped suddenly. Check service status on the Windows side of things and verify that you were using the default port, as it sits there's nothing listening for the Firewall to connect to anymore. 

[Tqpharma]

I upgrade firewall PAN-OS to 10.2 and it is working.