Palo Alto Networks Certified Network Security Engineer (PCNSE)Plan and DesignMedium
A multinational corporation is deploying Palo Alto Networks firewalls across its global offices. Each office has local domain controllers (DCs), and the company wants to implement User-ID to identify users for security policy enforcement. Due to network latency and security considerations, the design requires that User-ID agents be deployed locally at each office, forwarding user mapping information to the nearest firewall. Which User-ID agent deployment mode is most appropriate for this scenario?
- ASyslog-based User-ID agent.
- BWindows-based User-ID agent.
- CTerminal Server Agent.
- DAgentless User-ID on the firewall.
Show answer & explanationAnswer & explanation
Correct answer: B. Windows-based User-ID agent.
For environments with Active Directory and a need for local User-ID agents to gather user mapping from local domain controllers, a Windows-based User-ID agent is the most appropriate choice. It collects login events directly from the DCs.
Why the other options are wrong
- A. Syslog-based User-ID agents are used to parse user information from syslog messages, typically from other network devices, not directly from Active Directory login events.
- C. A Terminal Server Agent is specifically for environments with shared terminal services (like Citrix or Microsoft RDS) to map individual users to specific application sessions, not for general domain user mapping.
- D. Agentless User-ID relies on the firewall directly polling DCs, which can be inefficient over WAN links and may not scale well for many remote offices.
Windows-based User-ID Agent
A software agent installed on a Windows server that collects user-to-IP address mappings from Active Directory login events and forwards them to Palo Alto Networks firewalls.
- Integrates with Active Directory for user mapping.
- Reduces firewall load by offloading event log polling.
- Suitable for distributed environments with local domain controllers.
Memory trick: Who is where? User-ID knows.