Panorama itself never queries LDAP. To populate the user- and group-objects that you reference in Device-Group policy, Panorama must learn them from one firewall in the group. Designating that firewall as the Master Device enables Panorama to pull its existing User-ID (LDAP) mappings and present the group list for rule creation and enforcement. Without a Master Device, Panorama cannot retrieve or validate LDAP group information for the rules. (≤130 words)

A. Service route to LDAP server – Panorama does not connect to LDAP; the firewalls (User-ID) do, so no Panorama service route is required.

C. Authentication Portal – Provides web-based user authentication, not group mapping data for policy creation.

D. User-ID agent on the LDAP server – May collect mappings, but Panorama still needs a Master Device to import them; agent alone is insufficient.

1. Palo Alto Networks

Panorama Administrator’s Guide 10.2

“Configure a Master Device in a Device Group

” steps 1-3 (docs.paloaltonetworks.com) – explains that a master device supplies user/group mapping to Panorama for policy.

2. Palo Alto Networks

PAN-OS Administrator’s Guide 10.2

“User-ID Overview

” section “How User-ID Works with Panorama” (docs.paloaltonetworks.com) – states Panorama relies on a designated firewall for user and group information.

3. Palo Alto Networks LIVEcommunity

TechDocs Article ID 3621

“Using Group Mapping on Panorama Requires a Master Device” (paragraph 2).