When deploying User-ID in environments with diverse directory services, Palo Alto Networks firewalls have the capability to monitor several types of servers to gather user mapping information. Among the options provided:
C: Red Hat Linux, Microsoft Active Directory, and Microsoft Exchange:
* Red Hat Linux: Palo Alto Networks User-ID can monitor Linux systems to gather user information, typically by integrating with services like syslog or by using an agent that reads user login events.
* Microsoft Active Directory: This is one of the most common sources for User-ID, as Active Directory is widely used for user management and authentication. User-ID can directly integrate with Active Directory to read security event logs, capturing user login and logout events.
* Microsoft Exchange: While not directly monitored for user login events, Microsoft Exchange can be a source of IP-to-user mapping information, especially for users accessing email services. This can be achieved by parsing Exchange logs for client access information.
These platforms can provide valuable data for User-ID, enabling the firewall to apply policies based on user identity across diverse network environments.

https://live.paloaltonetworks.com/t5/panorama-discussions/panorama-force-template-value-option/td-p/496620 "- Force Template Value will as the name suggest remove any local configuratio and apply the value define the panorama template. But this is valid only for overlapping configuration" "You need to be careful, what is actually defined in the template. For example - if you decide to enable HA in the template, but after that you decide to not push it with template and just disable it again (remove the check from the "Enable HA" checkbox). This still will be part of the template, because now your template is explicitely defining HA disabled. If you made a change in the template, and later decide that you don't want to control this setting with template, you need to revert the config by clicking the green bar next to the changed value"

To prevent the import from affecting ongoing traffic when you import the configuration of an HA pair into Panorama, you should disable config sync on both firewalls. Config sync is a feature that enables the firewalls in an HA pair to synchronize their configurations and maintain consistency. However, when you import the configuration of an HA pair into Panorama, you want to avoid any changes to the firewall configuration until you verify and commit the imported configuration on Panorama. Therefore, you should disable config sync before importing the configuration, and re-enable it after committing the changes on Panorama12. References: Migrate a Firewall HA Pair to Panorama Management, PCNSE Study Guide (page
50)

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClETCA0 A device group is a logical grouping of firewalls that share the same security policy rules. A device group can contain multiple vsys and firewalls, including multi-vsys firewalls. A multi-vsys firewall can have each vsys in a different device group, depending on the desired security policy for each vsys. This allows for granular control and flexibility in managing multi-vsys firewalls with Panorama1. References: Device Group Push to a Multi-VSYS Firewall, Configure Virtual Systems, PCNSE Study Guide (page 50)