User-ID Data Redistribution refers to the mechanisms within PAN-OS for sharing IP address-to-username mappings learned by one component (like a User-ID Agent or Panorama) with other PAN-OS devices (firewalls or other agents). The goal is to ensure that multiple enforcement points have consistent and up-to-date User-ID information without requiring each device to independently query all the original mapping sources.
This is essential in environments with multiple firewalls, geographically distributed locations, or centralized management scenarios.
PAN-OS supports several ways to share/redistribute User-ID mappings:
Panorama > Collector Groups > [Group] > Agent
) or configure Panorama itself to collect mappings (if acting as an agent). Enable redistribution within the User-ID settings (
Panorama > User Identification > Setup
or similar paths depending on version/context).
Device > User Identification > Setup
) to retrieve mappings
from Panorama
. Ensure they are *not* also configured to pull directly from the same Agents that Panorama is using, to avoid conflicts.
graph LR
subgraph Sources
DC1[Domain Controller 1];
DC2[Domain Controller 2];
API[XML API Source];
end
subgraph Agents
Agent1[Windows Agent 1];
FW_Agent[Firewall w/
Integrated Agent];
end
subgraph Management
P[Panorama
Consolidates &
Redistributes];
end
subgraph Enforcement
FW1[Managed Firewall 1];
FW2[Managed Firewall 2];
end
DC1 -- Monitors --> Agent1;
DC2 -- Monitors --> FW_Agent;
API -- Sends --> Agent1;
Agent1 -- Pushes Mappings --> P;
FW_Agent -- Pushes Mappings --> P;
P -- Redistributes Mappings --> FW1;
P -- Redistributes Mappings --> FW2;
style P fill:#eaf2f8,stroke:#aed6f1,stroke-width:2px
Panorama Redistributing User-ID Mappings.
Device > User Identification > User-ID Agents
to accept mappings from the specific Agent IP address(es).
Configuring Panorama as the central redistributor is a common best practice:
Panorama > Collector Groups > ... > Agent
).
Panorama > User Identification > User Mapping > Server Monitoring
- requires Panorama management interface connectivity to DCs).
Panorama > User Identification > Group Mapping Settings
).
Panorama > User Identification > Setup > ???
(Exact path may vary slightly by PAN-OS/Panorama version - check relevant User-ID settings).
Device > User Identification > Setup
).
Device > User Identification > User-ID Agents
should be empty or point only to agents *not* monitored by Panorama if using a hybrid approach).
For the PCNSE exam, understand:
1. What is the main goal of User-ID Data Redistribution in a multi-firewall environment?
2. In a large environment managed by Panorama, what is the recommended best practice for distributing User-ID mappings to managed firewalls?
3. If Panorama is configured to redistribute User-ID mappings to managed firewalls, what configuration should typically be REMOVED from the managed firewalls?
4. Which component typically initiates the *push* of User-ID mappings in a redistribution scenario (excluding HA sync)?
5. What is the default TCP port used for communication between a Windows User-ID Agent and a PAN-OS firewall/Panorama for mapping redistribution?
6. How are User-ID mappings typically kept consistent between firewalls in an Active/Passive High Availability (HA) pair?
7. Can a firewall running the PAN-OS Integrated User-ID Agent redistribute mappings to other firewalls?
8. What is a potential consequence of network latency between Panorama (acting as redistributor) and a managed firewall?
9. Where on a receiving firewall do you configure it to accept User-ID mappings directly from a specific Windows User-ID Agent?
10. A firewall is managed by Panorama, and Panorama is configured to collect User-ID data from Agent-1. To ensure the firewall uses these mappings correctly, what should typically be configured on the firewall itself regarding Agent-1?