Directory Sync and Prisma access

cancel
Showing results for 
Search instead for 
Did you mean: 

Directory Sync and Prisma access

L1 Bithead

I'm considering using Directory Sync for my Panorama-managed Prisma access tenant and would like to clarify certain aspects of using Directory Sync.

- Is there a recommended number of Cloud Identity agent hosts to be deployed?

- Palo Alto's documentation says the certificates generated using the Cloud Identity Engine apps expires 3 months from issuance date and renews automatically for version 1.5.0 and above. Are there specific ports or app-IDs that need to be allowed in policy to ensure automatic renewal?

- In Panorama, when Directory Sync is enabled, a warning message is displayed saying: "After you enable Directory Sync, Prisma access obtains its user and group mapping information from the Directory Sync Service only, and any existing user and group mapping settings will be ignored".

    - Given the above error, does that mean there's the possibility of a temporary outage while the firewalls lose/clear any previous AD group information from LDAP profiles and update their information using Directory Sync?

    - If there are already policies in place that have been configured using the long-form Distinguished Name, will enabling Directory Sync affect the existing configured policies?

 

Thanks.

0 REPLIES 0
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!