Security

In an environment with multiple PAN firewall clusters, what is the recommended approach to sending UserIDs?

At the moment we are sending to the first member of each cluster.

Sending to Panorama only would result in a single point of failure in the design.

Would sending to both cluster members cause any problems?

We haven't tested specifically CPPM integration with PAN deployed in a cluster/HA. I think the question you ask below is more pertinent to Palo Alto rather an Aruba.

Fair enough

We ended up sending to both cluster members in two clusters for now which works.