The Palo Alto firewalls do not communicate with each other. They each only know about the user-id associations they get from agents associated with that firewall. With AD and user-id, the key to remember is that the ip address association for the user login will be in the server event log that authenticates the user. These local event log messages with the user and ip address only exist on the server that authenticates the user locally. These event message do not replicate as AD data does through the AD database. So for each firewall you will need to see how your rules are written for user-id and where the user was authenticated by AD. For example, if all of your rules are based on local users going out of the site, you likely only need the local AD for the firewall. When you login to any of your forest domains, this will be serviced by the local AD and logged there even if the actual account was created in one of the other two domains. But if your have inbound rules from the other two sites coming into the local site that require user-id, you likely will need the agent input from the remote AD because that is where the authentication took place. The other complication could come if you are using nat between any of the sites. Because the user-id will be based on the real ip address and if you nat that address the association would be lost.
... View more
