Windows Based Agent vs Integrated PANOS Agent

[IMTechSupport]

Hi everyone!

I was quite new to Palo Alto Networks and one that caught my attention is setting up user-id.

However, there are quite many videos which do not mention about the windows-based agent.

What are the advantages if I decided to use windows-based than the integrated PANOS agent? And vice versa.

Thanks!

[BPry]

@IMTechSupport,

Integrated

The primary advantage is that you don't need to worry about installing the agent on anything, you simply setup the permissions and can manage everything directly from the firewall. This is more attractive when you have a network that may not want to give PAN-OS administrators direct access to the server running the user-id agent (since you need to have access to a RODC if you choose to use the Domain Credential credential detection method). The admins would be able to manage everything directly from the firewall.

Windows Agent

Biggest advantage I can think of off hand is the ability to use the Domain Credential User Credential Detection setting instead of just IP User or Group Mapping. As soon as you want to utilize Domain Credential you absolutely need to be using the Windows-based User-ID agent on a RODC. This allows for much better detection without as many false positive submissions that you'll see using IP User or Group Mapping. 

I personally like the Windows user-id agent since it allows for the Domain Credential method. The number of phishing attempts that we identify directly on the firewall and prevent due to this is massive. However, I'm less of a fan of using the Windows agent when the firewall administrators wouldn't have access to the server to manage the agent. In certain installations we've intentionally avoided the agent because the PAN-OS administrators weren't going to have access to the RODC that it was running on to actually manage the agent directly. 

[TomYoung]

Hi @IMTechSupport ,

In addition to the Domain Credential Filter that @BPry mentioned, scale is also a consideration.  Here is a great article -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClpICAS.

Thanks,

Tom

[IMTechSupport]

@BPry Thank you very much! I will take a good read on this and let you know if I still have any questions.

[IMTechSupport]

@TomYoung Thank you! I will read this article as well.