User-ID Management Setting

[djr]

In the device management settings there is now a "User-ID" checkbox.  I have looked at the administrators guide but it doesn't mention it, presumably because it is fairly new.

What does this actually control, because the user-id agent on the box works fine without that checked (or seems to).  Other options such as SSH, ping etc are obviously management access protocols but user-id doesn't seem to fit in quite the same.

[panos · Accepted solution]

That option is needed to allow communication between firewalls when a firewall is acting as a redistribution point to provide user mapping information to other PAN-OS firewalls.Also it is available for management profile.You can distribute user id information as a new feature on panos 5

[zarina]

The userid option is introduced in 5.0 and need to be enabled when you are using the agentless user id and also when distributing the mappings to other firewalls

[djr]

Sorry to be obtuse, but I still don't get this.

I had agentless user-id turned on and working with my 5 DCs without this turned on, so it doesn't *appear* to prevent that working.

If it controls redistribution of the user-id information I can see why I wouldn't have noticed that, but does that then mean that I need the management addresses of the to firewalls to be included in the "permitted addresses" as well?

Thanks

[gwesson]

The checkbox allows that specific firewall to be the agent for other firewalls. It gives you a central user-ID agent that several firewalls can use without having to deploy software agents or set up the agentless configuration on every firewall.

Hope this helps,

Greg

[djr]

Not really, two specific questions then:

1) Is it needed to permit an XML API connection from an external server

2) Is it needed to replicate user ID data to the HA peer?

2a) If the answer to 2 is "yes", then does the peer firewall need to be in the permitted IPs list?