>
    Strata Copilot
    Configure Cloud Redistribution of User Context
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. PAN-OS Web Interface Help
    4. Configure Cloud Redistribution of User Context
    Download PDF
    Next-Generation Firewall

    Configure Cloud Redistribution of User Context

    Table of Contents

    Configure Cloud Redistribution of User Context

    Enable the sharing of user context such as IP address-to-username mappings across your Next-Generation Firewalls.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by PAN-OS or Panorama)
    • PAN-OS 12.2 or later
    • Valid device certificate from the Customer Support Portal
    As Next-Generation Firewall (NGFW) deployments scale across sites and regions, sharing user context (identity mappings, for example) across NGFWs ensures consistent policy enforcement. Cloud redistribution enables NGFWs to exchange mapping information without requiring direct peer-to-peer connections between them. The User Context Cloud Redistribution Service acts as a central exchange point: NGFWs upload the user context they learn locally and download what they need from other NGFWs through the service.
    The user context (data types) supported for redistribution through the User Context Cloud Redistribution Service are as follows:
    Data TypeDescription
    IP Port
    Maps an IP address to the specific port range that the Terminal Server agent allocates to a Windows-based terminal server user. This mapping identifies individual users in environments, such as Virtual Desktop Infrastructure (VDI), where multiple users share the same IP address.
    IP Tag
    Maps an IP address to a network tag, which enables you to enforce security policy rules using Dynamic Address Groups.
    IP User
    Maps an IP address to a specific username. This information is gathered from various sources, including GlobalProtect, Authentication Portals, Syslog, XML APIs, XFF Headers, and Server Monitoring.
    User Tag
    Maps a tag to a user, which enables you to enforce security policy rules based on user attributes with Dynamic User Groups.
    Quarantine List
    Lists devices that GlobalProtect or Cortex XDR flagged as compromised or non-compliant, so you can block them from accessing your network.
    Data flows through segments, which are logical groupings of NGFWs you define based on region or other use cases. You control which data your NGFW contributes or receives and the segments through which that data flows. Each NGFW can contribute a given data type to only one segment but can receive from multiple segments.
    You can choose one of two operation modes for the cloud service:
    • Legacy—NGFWs poll the cloud service continuously for user context updates, and you manage the data type and segment configuration through the Cloud Identity Engine (see Cloud Identity Engine User Context.)
    • Advanced Mode—The cloud service processes data asynchronously and notifies NGFWs when new data is available instead of requiring continuous polling. In this mode, the cloud service reduces NGFW bandwidth and CPU usage and maintains performance as your deployment scales. You configure segments and data types directly on the NGFW or Panorama, with per-data-type control over what each firewall contributes and receives.
      When you enable the NGFW connection to the cloud service, the NGFW initiates contact with the Discovery Service, which returns the FQDN for the regional deployment of the cloud redistribution service. This is based on the region you select for your Cloud Identity Engine instance.
    If you have multiple virtual systems (vsys), you can select a vsys as a User-ID hub to share identity mappings between virtual systems. For a given data type, all vsyses must use the same segment ID and the same contributing setting (all enabled or all disabled). To receive data, you must configure a hub vsys: the hub vsys downloads mappings from the cloud and distributes them to all other vsyses. If no hub vsys is configured, the commit fails.
    • All NGFWs in your deployment must use the same operation mode. You cannot mix Legacy and Advanced Mode across NGFWs.
    • Switching from Legacy to Advanced Mode does not migrate existing identity mappings. After switching, you can restore real-time data by having users re-authenticate or restore persistent data by resubmitting your XML API calls.
    • Segments do not span multiple virtual systems. Each vsys can independently contribute to one segment and receive from one or more segments.
    1. Register your NGFW on the Palo Alto Networks Customer Support Portal (CSP).
    2. Retrieve a device certificate from the CSP.
      The cloud redistribution service uses this certificate to authenticate with the cloud.
    3. Associate your NGFW with a tenant service group (TSG).
    4. Activate the Cloud Identity Engine for the TSG.
      The region you select for your Cloud Identity Engine instance determines which regional deployment of the User Context Cloud Redistribution Service your NGFW connects to.
    5. Enable the NGFW connection to the User Context Cloud Redistribution Service.
      If NGFW traffic uses a management interface, create security policy rules to allow connectivity between the NGFW and the cloud service.
      1. Select DeviceSetupManagement and Edit the PAN-OS Edge Service Settings.
      2. Enable User Context Cloud Redistribution Service.
      3. For Operation Mode, choose Advanced Mode or Legacy.
        Legacy mode requires additional configuration as described in Cloud Identity Engine User Context.
      4. Leave the Discovery Service Address as is.
        The Discovery Service Address is pre-configured with the default endpoint and is not expected to change under normal circumstances.
      5. (Optional) Enter a Discovery Service Refresh Interval (Hrs) (range is 1 to 240; default is 4).
        This interval controls how often the NGFW contacts the Discovery Service to refresh the regional endpoint FQDN for each data type.
      6. Click OK.
    6. Configure the data type your NGFW contributes and the segment to which it contributes that data.
      1. Select DeviceCloud RedistributionContributing and Add an entry.
      2. Choose a Data Type to contribute:
        • IP Port
        • IP Tag
        • IP User
        • Quarantine List
        • User Tag
      3. (Optional) Enter a Description for the entry.
      4. Enable Cloud Redistribution to activate the entry.
      5. Enable Contributing to upload this data type from the NGFW to the cloud service.
      6. Add a descriptive segment Name.
        Use a name that identifies the segment's purpose, such as its region.
      7. Add a segment ID.
      8. Click OK.
      9. (Optional) Add additional entries for other data types and segments as needed.
    7. Configure the data types your NGFW receives and the segments it receives that data from.
      1. Select DeviceCloud RedistributionReceiving and Add an entry.
      2. Choose a Data Type to receive:
        • IP Port
        • IP Tag
        • IP User
        • User Tag
        • Quarantine List
      3. (Optional) Enter a Description for the entry.
      4. Enable Cloud Redistribution to activate the entry.
      5. Enable Receiving to download this data type from the cloud.
      6. Add a descriptive segment Name.
        Use a name that identifies the segment's purpose, such as its region.
      7. Add a segment ID.
      8. Click OK.
      9. (Optional) Add additional entries for other data types and segments as needed.
    8. Commit your changes.
    9. Verify the NGFW connection to the User Context Cloud Redistribution Service.
      Select DeviceSetupManagement. In the PAN-OS Edge Services section, confirm that Connection Status for this service is connected (green dot).

    © 2026 Palo Alto Networks, Inc. All rights reserved.