USE IDENTIFICATION WITH 100 PAN AGENT

[alle]

Hello,

I must use 100 PAN AGENT (limit of product) for a project. Someone have already test to use 100 pan-agent ( 25 by VSYS*5)?

do you know if the Palo alto (PA5060) work fine with this number of pan-agent.

regards,

ALLE

[mikand]

Sorry I havent tested that many but what kind of limit is forcing you do to this?

[alle]

Mikhand

because you can't have a shared pan agent when you use VSYS!!.

So if you have 10 vsys and you have 5 site with ACTIVE DIRECTORY and you want do HA on each SITE :

10VSYS*(5 panagent*2(HA))= 100 pan agent

and I can't use an another architecture. (I have already discuss of this problem with Palo Alto)

I just need to know if someone have already try to use 100 PAN AGENT

[mikand]

And I guess it wont work if two different VSYS (or for that matter two different PA devices) use the same panagent?

Because (if we ignore redundancy for a short moment) one pan-agent per site will serve whatever this site has in its directory. Then no matter if you use 10 VSYS or 10 PA devices I think they should be able to speak to the same pan-agent (since the pan-agent is just a proxy between how PA wants the information and how the AD (or whatever) can present it).

Or is a pan-agent limited to only serve a single PA device (or VSYS) at a time?

[ucteam]

Yes I've successfully conected 100 UserID agents. All back to a single vsys.

I've also requested that PA have the 100 UserID agent limit increased and the max DC's limit... as the limits seems arbitrary and unnecessarily restricts design options for large networks.

[alle]

OK I Confirm that PA can support 100 PAN AGENT

thks,