Passive Identity Agent Primary/Secondary Agent Deployments

To provide redundancy and to avoid a single point of failure, you can configure primary and secondary passive identity agents in any of the ways shown in this topic.

You can install a passive identity agent on the AD domain controller, directory server, or on any client connected to the domain you wish to monitor.

Single AD domain controller with primary and secondary agents

The following figure shows how to set up primary and secondary passive identity agents on one AD domain controller. If the primary agent fails, the secondary takes over.

The advantage of using primary and secondary passive identity agents is that if the primary agent does not communicate with the Cloud-delivered Firewall Management Center for any reason, the secondary takes over. You can use any of the other types of deployments (in other words, primary/secondary agents monitoring one AD domain or multiple domains

To set this up:

  1. Create a Microsoft AD realm that has one directory for the domain controller.

    See Create an LDAP Realm or an Active Directory Realm and Realm Directory.

  2. Install the passive identity agent software on any two network machines connected to the domain controller.

    Configure each passive identity agent individually to communicate with the Cloud-delivered Firewall Management Center on which you configure the passive identity agent source.

    See Install the Passive Identity Agent Software.

  3. Create the identity source.

    See Create a Primary or Secondary Passive Identity Agent Identity Source.

Multiple AD domain controllers, primary and secondary agents

An example of primary and secondary agents installed on different AD domain controllers, all sending user IP information to the firewall manager

The preceding figure shows how to configure primary and secondary agents to monitor three AD domain controllers. If the primary agent fails, the secondary agent takes over.

To set this up:

  1. Create a Microsoft AD realm that has one directory for the domain controller.

    See Create an LDAP Realm or an Active Directory Realm and Realm Directory.

  2. Install the passive identity agent software on any machine connected to the domain controller.

    Configure each passive identity agent individually to communicate with the Cloud-delivered Firewall Management Center on which you configure the passive identity agent source.

    See Install the Passive Identity Agent Software.

  3. Create the identity source.

    See Create a Primary or Secondary Passive Identity Agent Identity Source.