About KiCheon.Lee

KiCheon.Lee · ‎08-18-2015

Hello jwolach, I apologize to give you my feedback late. I have been stuck another emergency job. I tested it yesterday as you mentioned. It is so greate!!!!!! your answer is perfect. Thank you very much. I like it. My customer is pretty satisfactory for your help. Could you pleae let me know one more question? Can I modify character in button from English to Korean Language? I say again, thanks for your help.

KiCheon.Lee · ‎08-05-2015

Hello Jeff, Thanks for your kindness. I have retried it as you helped. But I can not make button size is more bigger. Here is a my URL continue response page. Please let me know it why not. <html> <head> <title>Application Blocked</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <link rel="stylesheet" type="text/css" href="/styles/falcon_content.css?v=@@version"> <META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE"> <style> #content{background-color:#f2f2f2;margin:40;padding:40;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:15px;} h1{font-size:30px;font-weight:bold;color:#FF0000;line-height:90%;} a{font-size:30px;font-weight:bold;color:#000000;line-height:90%;} b{font-weight:bold;color:#000000;line-height:180%;} input.buttonFixed { font-weight: bold; width: 800px; margin: 5px 0px 4px 4px; } </style> </head> <body bgcolor="#f2f2f2"> <div id="content"> <table width="800" align="center" cellspacing="0" style="border-collapse:collapse;" height="425" border="0"> <tr> <td align="center" height="80"><font face="맑은 고딕"><h1>해당 사이트의 메일 쓰기는 차단 됩니다.</h1></font></td> </tr> <tr> <td width="800" height="220" valign="top" align="left"> <font face="맑은 고딕"> <h2>메일 확인은 로고 아래에 있는 "continue"를 클릭해 주세요. <h2> <b>문의사항은 Helpdesk (02-1234-4567)로 연락 바랍니다.</b><br> <b>사용자 : </b> <user/> <br> <b>접속 URL : </b> <url/> </font> </td> </tr> <tr> <td align="center" height="30"> <pan_form/> </td> </tr> </table> </div> </body> </html>

KiCheon.Lee · ‎08-02-2015

Hi Jeff, Thank you very much for your answer. Excuse me, please let me look at the full html. I am trying it. but web page does not go to next page when click "continue" Thanks, KC Lee

KiCheon.Lee · ‎07-31-2015

Hello jwolach, Did you find it out how continue button can be bigger? If you knew, please let me know it. My customer is also complaining. Thanks, KC Lee

KiCheon.Lee · ‎07-22-2015

Hello, I had set ssl-decryption on FW to connect GMail. The below screenshot shows. Probalbly, It is FW's response page. What is this?

KiCheon.Lee · ‎07-16-2015

Hello mmmccorkle, Thanks for your kind answer. I have a question more deep. What about below threats? 1) RIG Exploit Kit Detection (36683, 37561) 2) WGeneric.Gen Command and Control Traffic (13621, 14210) 3) Suspicious.Gen Command And Control Traffic (14035, 14137, 14155) 4) ANGLER Exploit Kit Detection (37744, 37796) These threat-IDs are also same each other. Thanks, KC Lee

KiCheon.Lee · ‎07-08-2015

Did you find it out why there are two threat IDs? If yes, please let me know it. Thanks, KC Lee

KiCheon.Lee · ‎06-29-2015

Hello, I have questions about Minimum Password Complexity. If "minimum length" is set to some value, all accounts of administrator and local-DB are limited by this value of minimum length. But if "Require Password Change on First Login" is set to enable, only accounts of administrator are limited by it not local-DB. Is it right? If yes, Does "Password Format Requirements" influence administrator and local-DB? But Does "Functionality Requirements" influence only administrator? Thanks, KC Lee

KiCheon.Lee · ‎06-28-2015

Do you know what method for key exchange else DH to access mgmt web ?

KiCheon.Lee · ‎06-09-2015

Hello, How to be status are there 'grayware' on wildfire portal? I have not seen it. I expect grayware is between malware and benign. But I would like to know it correct. Thanks, KC Lee

KiCheon.Lee · ‎05-18-2015

Thanks for your kind answer. I wrote wrong for case2. I mentioned the following sentences "case 2. <SKIP> If yes, my customer said there are "incomplete" and insufficient-data" logs on rule2 be allowed." I wanted to say "If yes, my customer said there are "incomplete" and insufficient-data" logs on rule1 be allowed." not rule2. I am so sorry. and I appreciate your watching patient for my question. Thanks, KC Lee

KiCheon.Lee · ‎05-14-2015

Hello, First, I want you know I don not speak English very well. I understood your mention. But I just want to know results on two cases what rule is matched. case 1. There are only two rules. rule1 ; source address any ; destination address any ; application bittorrnet ; service any ; action allow rule2 ; source address any ; destination address any ; application any ; service any ; action deny in this case, you and I knew what packets before identified application are matched to rule1 and then PA will allow them. Packets After identified application are matched to rule2 and then PA will deny them. If session ended before identified application, PA will record as below log on traffic logs. "application incomplete or insufficient-data ; action allow , rule1" case 2. There are also only two rules rule1 ; source address any ; destination address any ; application bittorrent ; service any ; action deny rule2 ; source address any ; destination address any ; application any ; service any ; action allow. I tested packets are matched what rule before indentified application. So I sent only syn-packet and not successful for 3-way handshake. I checked traffic logs and looked this a packet was matched to rule2 with incomplete. NOT rule1 with same "service any". Is it right? If yes, my customer said there are "incomplete" and insufficient-data" logs on rule2 be allowed. So I do not understand why it happen and I need your help. Thanks, KC Lee

KiCheon.Lee · ‎05-13-2015

Hello Steven Puluka, Thanks for your answer. I understand your detail explanation. But my customer does not want to allow any traffic on blocking rules. I had tested about it on another case. I sent a only syn packet to another destination IP else matched torrent rule IPs on traffic logs. This packet was matched allowing on "any any allow" rule, not torrent rule. So I think PA remember destination address and application and then when packets of same destination address receive, PA keep theses packets on previously matched rule by using application cache and allow it on this rule before identified application. So I expect if application cache was disable, packets before identified application will be matched "any any allow" rule. PA never allow any packet on blocking rule. Would be it right? If my thought is wrong, I hope to get your help. Thanks, KC Lee

KiCheon.Lee · ‎05-13-2015

In addition, both incomplete and insufficient-data are allowed by blocking torrent rule.

KiCheon.Lee · ‎05-13-2015

Hello, My question is based the following document. How Application-Default in the Rulebase Changes the Way Traffic is Matched The case on above document is allowing rule. I wonder another case when there is a blocking rule with service any how traffics are matched. There are rules as below image. I have found some odd traffic logs out as below screenshot. There are traffic logs application are incomplete and insufficient-date else bittorrent. I do not understand why these traffics were matched torrent's rule. I expect traffics wiil be matched this rule after identified bittorrent application when blocking rule case. Probably, Were traffics matched by application cache? I think application cache affect it happened. How do you think it? And I need your help. Thanks, KC Lee

Member Since	‎04-29-2011 08:30 AM
Date Last Visited	‎07-20-2020 07:48 PM
Posts	195
Total Likes Received	15

Online Status	Offline
Date Last Visited	‎07-20-2020 07:48 PM

About KiCheon.Lee

Rest API about "export table" button for exporting rules"

I want to ignore to update ip-user-mapping information from other domain.

What purpose is 'parent app' when to create custom app?

HA1 interface was down during 1 second by restarting connection after heartbeat failure.

Re: About throughput performance with only url filtering

About throughput performance with only url filtering

Re: About FSCK on Panorama

Re: About FSCK on Panorama

About FSCK on Panorama

Re: What OS on windows server can PA support about global protect?

About HA1 connection down in system critical log.

Re: Can I make custom application signature for using referer of http header?

Re: What does 'devsrvr' daemon operate?

Re: Custom Button on URL Continue Response Page

How many can I create url-filtering profile on 5050?

Re: What OS on windows server can PA support about global protect?

Re: Can I make custom application signature for using referer of http header?

Re: What OS on windows server can PA support about global protect?

Re: About address and EBL limitation for maximum

Re: What does 'devsrvr' daemon operate?

Re: Custom Button on URL Continue Response Page

Re: Custom Button on URL Continue Response Page

Re: Custom Button on URL Continue Response Page

Re: Custom Button on URL Continue Response Page

What is response page of "Certificate Error"?

Re: Threat ID 30852 and 35107 - HTTP /etc/passwd Access Attempt

Re: Threat ID 30852 and 35107 - HTTP /etc/passwd Access Attempt

About Minimum Password Complexity

Re: New Logjam Attack

How to be status are there 'grayware' on wildfire portal?

Re: When blocking rule with service any, How are traffics matched?

Re: When blocking rule with service any, How are traffics matched?

Re: When blocking rule with service any, How are traffics matched?

Re: When blocking rule with service any, How are traffics matched?

When blocking rule with service any, How are traffics matched?

Unlock your full community experience!

About KiCheon.Lee