Panorama passive device redistributing User-ID mappings?

[Carracido]

Dear community!

We have configured user-ID redistribution to send mappings to firewalls from Panorama. The same config as the following: 

https://www.packetswitch.co.uk/palo-alto-user-id-redistribution/

We have to panoramas in active/passive and some firewalls are having alarms like the following:

Issue description :: Redistribution Agent Panorama2(vsys1):  details: close connection to agent.
Severity :: High

That´s is the passive Panorama. I assume that the passive Panorama doesn´t participate in the User-ID redistribution and thus the firewall cannot just connect to its User-ID agent service. Anyone could confirm this? I didn´t find any statement in official resources.

Thank you in advance!

[nohash4u]

HI @Carracido, 

I can confirm similar behaviour with the NGFWs. I wrote a thread on it here: LIVEcommunity - Food for Thought - Data Redistribution during HA Failover - User-ID - LIVEcommunity ... 

On a similar thread, recently I moved a configuration towards Panorama being used as the Data Redistribution Agent. I did configure the Data Redistribution Clients (the NGFWs) to connect to the Data Redistribution Agent on Panorama via host and port, however, I am curious if configuring the Data Redistribution Clients (the NGFWs) to connect to the Data Redistribution Agent on Panorama via Serial Number will make a difference. In my case, Panorama was not HA, so the problem does not apply. 

Let me know your thoughts!