All GlobalProtect gateways and firewalls that
redistribute HIP reports must have a GlobalProtect
Gateway license (Panorama appliances that redistribute
HIP reports do not require a GlobalProtect gateway
This functionality is included with a Prisma Access Mobile
To ensure consistent Host Information Profile (HIP) policy enforcement and to simplify policy
management, you can distribute HIP reports from the GlobalProtect internal or
external gateway to other firewalls, and Panorama appliances in the enterprise. HIP
report redistribution can be useful in the following cases:
You want to apply consistent policies to both
internal and external GlobalProtect gateways.
You want to apply consistent HIP policies for traffic for
a specific user that goes through multiple firewalls.
To redistribute HIP reports, use the same deployment recommendations and best practices that you
use to redistribute User-ID information. Keep in
mind that GlobalProtect internal and external gateways do not support bi-directional
HIP redistribution. Therefore, the best practice is to use your Panorama appliance
as your redistribution point. In this deployment, you would configure your internal
and external gateways to send the HIP reports to Panorama and have Panorama forward
them on to your firewalls for consistent policy enforcement across your
the following steps to configure HIP report redistribution.
The agent must be a Palo Alto Networks next-generation firewall, a GlobalProtect gateway, or a
If you use GlobalProtect firewalls or gateways to distribute
HIP reports, make sure that the group mapping settings on the firewalls
or gateways that you use to redistribute the HIP reports match the
following attributes on the firewalls or gateways where you have
If you use a Panorama appliance to distribute HIP reports, skip this step.
user attributes on the HIP report redistribution firewalls or gateways
to match the user attributes on the User-ID firewalls or gateways.
example, if the firewalls or gateways used for HIP report redistribution has
a sAMAccountName of
a User Principal Name (UPN) of
Alternate Username 1
make sure that you configure the same values on the firewalls or
gateways where you have configured User-ID.
do not have to be in the same order; for example, if the HIP report
redistribution firewall has a sAMAccountName of
and a UPN of
, you can configure the User-ID firewall with a sAMAccountName
and a UPN of
If your deployment has user domains configured in its group
mapping, configure the user domain attributes on the HIP report
redistribution firewalls or gateways to match the user domain attributes
on the User-ID firewalls or gateways. User domain attributes must
be consistent across all firewalls and gateways.
Configure the common user groups (the user groups on the
firewalls and gateways that connect to the same authentication servers
and retrieve the same user groups) on the HIP report redistribution
firewalls or gateways to match the user groups on the User-ID firewalls