User-ID Redistribution Enhancement

You can now relay user mapping information from one firewall to another in a sequence of up to ten firewalls instead of only two. This increase in the relay sequence enables you to redistribute mapping information in a large-scale network that has hundreds of user identification sources or that has users who rely on local sources for authentication (such as regional directory services) but who require access to remote resources (such as global data center applications). Redistributing mapping information also reduces the resources that firewalls and information sources use because fewer firewalls query the sources directly.

Figure: User-ID-Redistribution shows how you can organize the redistribution sequence in layers, where each layer has one or more firewalls. In this example, bottom-layer firewalls in local offices redistribute mapping information to middle-layer firewalls in regional offices, which redistribute to one top-layer firewall in a global data center. The data center firewall redistributes the mapping information to other data center firewalls so that they can enforce global policies for all users.