A company with Palo Alto Networks NGFWs protecting its physical data center servers is experiencing a performance issue on its Active Directory (AD)…

When high traffic from Palo Alto Networks NGFWs to Active Directory servers causes performance

issues, optimizing the way NGFWs gather user-to-IP mappings is critical. Palo Alto Networks offers

multiple ways to collect user identity information, and Cloud Identity Engine provides a solution that

reduces the load on AD servers while still ensuring efficient and accurate mapping.

Option A (Correct): Cloud Identity Engine allows NGFWs to gather user-to-IP mappings directly from

Active Directory authentication logs or other identity sources without placing heavy traffic on the AD

servers. By leveraging this feature, the NGFW can offload authentication-related tasks and efficiently

identify users without overloading AD servers. This solution is scalable and minimizes the overhead

typically caused by frequent User-ID queries to AD servers.

Option B: Using GlobalProtect Windows SSO to gather user information can add complexity and is

not the most efficient solution for this problem. It requires all users to install GlobalProtect agents,

which may not be feasible in all environments and can introduce operational challenges.

Option C: Data redistribution involves redistributing user-to-IP mappings from one NGFW (hub) to

other NGFWs (spokes). While this can reduce the number of queries sent to AD servers, it assumes

the mappings are already being collected from AD servers by the hub, which means the performance

issue on the AD servers would persist.

Option D: Using GlobalProtect agents to gather user information is a valid method for environments

where GlobalProtect is already deployed, but it is not the most efficient or straightforward solution

for the given problem. It also introduces dependencies on agent deployment, configuration, and

management.

How to Implement Cloud Identity Engine for User-ID Mapping:

Enable Cloud Identity Engine from the Palo Alto Networks console.

Integrate the Cloud Identity Engine with the AD servers to allow it to retrieve authentication logs

directly.

Configure the NGFWs to use the Cloud Identity Engine for User-ID mappings instead of querying the

AD servers directly.

Monitor performance to ensure the AD servers are no longer overloaded, and mappings are being

retrieved efficiently.

Reference:

Cloud Identity Engine Overview: https://docs.paloaltonetworks.com/cloud-identity

User-ID Best Practices: https://docs.paloaltonetworks.com