Why the User-ID Agent status of passive device on HA mode shows not-conn:idle?

[willstech]

Hello there.

I have a question related to a User-ID Agent.

My PA-5050 is configured with HA mode (Active-Passive).

Couple of devices are connected User-ID Agent.

There are user agent connection status on the both of devices.

Active Device

Name             Host            Port  Vsys    State             Ver Usage

---------------------------------------------------------------------------

AD           10.40.29.64      5007  vsys1   conn:Get IPs      5

Passive  Device

Name             Host            Port  Vsys    State             Ver Usage

---------------------------------------------------------------------------

AD           10.40.29.64       5007  vsys1  not-conn:idle     0

my question is why the Passive Device Status is not-conn:idle?

is it normal status as a passive device on the HA mode??

Please let me know if someone who know of it.

Thanks,

Eugene.

Message was edited by: Yujin Won

[mikand]

Is the userid-service on the PA box using a dataplane interface or the management interface to reach the 10.40.29.64 box?

Because when using active/passive the passive unit dataplane is basically disabled (regarding forwarding) until the unit becomes active. Which gives that only the physical management interface is the only interface which is always active no matter if the unit is in active or passive state.

[willstech]

The both active and passive devices are only using a management Interface to communicate with the User-ID Agent (10.40.29.64).

The both devices are configured with V-wire mode.

I can access the passive device web UI through management interface.

Therefore, Management interface on the Passive device is working well.

But User-ID Agent connection state on the passive device shows the not-conn:idle.

[TheSquire · Accepted solution]

This is expected behaviour as only the primary device will be used for user-id, then all the mappings will sync to the passive device

You can verify this by setting the current primary to suspend to force a failover, at which point you should see the new primary connect to the user agent.