Download Palo Alto User-id Agent ~REPACK~

Ya, that's not how it works. The user-id agent simply reads the event logs, it doesn't listen to the network traffic or anything like that. Uninstalling the agent or re-installing the agent absolutely should have no effect on the speed of your Domain Controllers or Netlogon connections.

From looking at the admin GUI, I would think that I could install the user-id agent onto each of my DCs, configure the user agent to look only at the DC it is installed onto, and point the Palo Alto Firewall to each DC.

Download Palo Alto User-id Agent

DOWNLOAD 🔥 https://urllio.com/2y7Z7H 🔥

From using user agents from Surfcontrol, M86, and others, I am aware that the potential exists for a user in remote location #5 to do something that creates an authentication ticket on the remote DC security logs at location #2. Then the user-id agents at location #5 and #2 could then have conflicting information about where that user is signed on.

So I would assume that I could solve that issue by having each user-id agent monitor only the network that is on. So location #5 would monitor 192.168.5.0/24 and location #2 would monitor 192.168.2.0/24. That does introduce the problem that if location #5's user agent were to go offline, I would possible have NO user agent monitoring locaiton #5 and thus user mapping would quit. However, in my case, location #5's DC is a Citrix Branch Repeater acting as a DC and a layer 2 bridge. If it goes down, I have big problems.

In particular, it says the Palo Alto firewall will select one User ID agent, and that is what it polls. Not the others. So all of this fancy design I have in my head would not work. I'm back to my original problem, the user-id agent is consuming many GB per hour. How do I solve this issue?

After configuring this you can monitor both log files to verify proper operation and then later verify PAN-OS is properly receiving the bloom filters. Be sure to restart the user-id agent after making any changes.

Thanks for your reply John. Yes, it works ok from a mobile device they are received by freeradius as username and pushed to the palo alto as domain\username however windows devices are received by freeradius as domain\\username and pushed to palo alto as domain\domain\\username. 006ab0faaa