Palo Alto Networks Certified Network Security Engineer (PCNSE)Plan and DesignMedium

A multinational corporation is deploying Palo Alto Networks firewalls across its global offices. Each office has local domain controllers (DCs), and the company wants to implement User-ID to identify users for security policy enforcement. Due to network latency and security considerations, the design requires that User-ID agents be deployed locally at each office, forwarding user mapping information to the nearest firewall. Which User-ID agent deployment mode is most appropriate for this scenario?

  1. ASyslog-based User-ID agent.
  2. BWindows-based User-ID agent.
  3. CTerminal Server Agent.
  4. DAgentless User-ID on the firewall.
Show answer & explanation

Correct answer: B. Windows-based User-ID agent.

For environments with Active Directory and a need for local User-ID agents to gather user mapping from local domain controllers, a Windows-based User-ID agent is the most appropriate choice. It collects login events directly from the DCs.

Why the other options are wrong

  • A. Syslog-based User-ID agents are used to parse user information from syslog messages, typically from other network devices, not directly from Active Directory login events.
  • C. A Terminal Server Agent is specifically for environments with shared terminal services (like Citrix or Microsoft RDS) to map individual users to specific application sessions, not for general domain user mapping.
  • D. Agentless User-ID relies on the firewall directly polling DCs, which can be inefficient over WAN links and may not scale well for many remote offices.

Windows-based User-ID Agent

A software agent installed on a Windows server that collects user-to-IP address mappings from Active Directory login events and forwards them to Palo Alto Networks firewalls.

  • Integrates with Active Directory for user mapping.
  • Reduces firewall load by offloading event log polling.
  • Suitable for distributed environments with local domain controllers.

Memory trick: Who is where? User-ID knows.

More Plan and Design questions