User-ID agent upgrade path

[Reece.Boucher]

Greetings,

I am running NGFW x 35 (10.2.10-h3) and User-ID Agent 10.2.2-111, which I believe needs to be upgraded to avoid the Nov-18 issue.

My question is, does the User-ID Agent need to remain in the same stream as NGFW (ie. 10.2.x) or can it go to the 11.0 stream?

A side question (because I inherited this environment) ...

If I have the 'standard' User-ID agent installed can I do a clean upgrade of the #UaCredInstall version over the top?  Is there any additional configuration required

[arusharma]

Install the User-ID agent version that is the same as the PAN-OS version running on the firewalls. If there is not a User-ID agent version that matches the PAN-OS version, install the latest version that is closest to the PAN-OS version.

Step 3: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/user-id/map-ip-addresses-to-users/configu...

You can do clean and over the top both make sure it happens in a maintenance window.

[CosminM · Accepted solution]

Hello @Reece.Boucher

If you are running on your firewalls PAN-OS 10.2.10-h3 and your User-ID Agent version is 10.2.2-111, then you don't need to do any upgrade or hotfix installation to mitigate Nov 18 certificate issue.

You can see the minimum required versions on Table 1 here: https://live.paloaltonetworks.com/t5/customer-advisories/update-to-additional-pan-os-certificate-exp... .