Bidirectional User-id redistribution between Prisma access and on-prem Firewalls

[Richa_Sharma]

Hello Everyone,

My user-id redistribution topology is as follows:

Prisma access --> Azure VM 300 firewall --> On-prem PA Firewalls (about 4 HA Pairs) and vice -versa as i need bidirectional ip-username mappings.

Reason to do directional mappings is that We have GP users and branch users on prisma access for which i need user-id mapping and also, on local firewalls, we have internal gateways configured and local site users are hitting these internal gateways for which we need user-id mappings. 

I am able to get user id mappings for GP users from Prisma access but unable to get the mappings for the Remote network users and local firewalls users.

Please suggest. 

[nikoolayy1]

Why do you have issues with this ? As shown in the documentation you can select a master device https://docs.paloaltonetworks.com/prisma/prisma-access/3-2/prisma-access-panorama-admin/configure-us... that can feed this data to Prisma Access. Also if you use the Cloud Identity Engine (CIE) as authentication source for the on-prem firewalls it will feed the prisma access https://docs.paloaltonetworks.com/cloud-identity/cloud-identity-engine-getting-started/get-started-w...

Also if your Service Connection DC is the one that needs to send the data see :

https://live.paloaltonetworks.com/t5/prisma-access-discussions/prisma-access-mobile-users-user-id-da...