master device in panorama device-group if using dataplane interface

[Deepak_K]

Due to high cpu utilization in firewall , we want to use dataplane interface of firewall for user-id services.

Currently , when primary firewall failover to secondary we do not require to change master device in panorama device-group.

How panorama collecting user-id info if primary firewall which selected as a master in device-group becomes passive ?

What if Primary firewall goes completely down ?

If we use dataplane interface, do we require to change master device in Panorama device-group if failover happens ? 

[Remo]

Hi @Deepak_K 

Sorry for asking, but how should using dp interface for user-id help with reducing the load on the cpu?

The master device is defined by firewall serial number, so it does not matter if you use cp or dp interface. The user-id information is collected from this specified master device, so if the master goes down panorama is no longer able to collect these informations.

[aleksandar.astardzhiev]

Hi @Deepak_K ,

I am only guessing, but:

- If you use dataplane interface for user-id in active-passive HA both devices will use same ip address so in case of failover the backup should establish connection to the server/user-id agent

- User-ID information is synced between members in active-passive HA.

So in theory in case of failover, secondary device will get user-id info monitored server/user-id agent and sync it to primary member, which Panorama will still use. But this is valid of the primary FW is still alive (listed as passive in the HA cluster) and able to communicate with Panorama.

[Deepak25]

Thanks Alexander,

User-id(users/group) info from primary to panorama will sync via which interface mgmt or dataplane?

Condition: service route on HA pair for LDAP and uid service is on dataplane interface. Master device in Panorama device-group is primary firewall and now secondary firewall is active