About KiCheon.Lee

KiCheon.Lee · ‎02-04-2015

Hello, I need your help. PA identify to RSH app-id when use tcp/514(standard port). And PA also dentify to R-EXEC app-id when use tcp/512. But PA identify to unknown-tcp when these applications use to change TCP port to 80. Would theses applications depend standard port??? Thanks.

KiCheon.Lee · ‎01-26-2015

Hello I need your help. I look out flow_sfpwq_taildrop counters increase high when I monitor PA. So I wonder what this counter mean. And I also wonder whether this counter influence real traffic or not. Thanks.

KiCheon.Lee · ‎12-10-2014

Thank you for your answer. Do you think same that many users use a same account?

KiCheon.Lee · ‎12-09-2014

Hello, My customer' office use SSL-VPN with Cisco ASA. We are going to change Paloalto FW instead of ASA. All employees use shared a account for SSL-VPN. How many users can a account connect into global protect? It is used a same account. Thanks, KC Lee

KiCheon.Lee · ‎11-27-2014

Hello, I am testing to allow for FTP(all both active & passive mode) on A-A with asymmetric routing environment. Session of control channel on FTP such as login has no problem. But I can not connect data-channel. It seems cutting data session. So I tried packet capture in FW. Syn/Ack packet on data-channel was dropped by FW. I guess root cause of this issue is FW can not synchronize predict session on A-A with asymmetric routing environment? Is it right? I need your advise. Thanks, KC Lee

KiCheon.Lee · ‎11-18-2014

Hello. I have a question about other ip flood in dos protection. Is other ip flood all protocol excepted TCP , UDP and ICMP? I want to know protecting ack flood. Thanks and Regards.

KiCheon.Lee · ‎10-22-2014

Wow~. Thank you very much~ Roh, dreputi, hshah, panos. My worry is broken by you and get good energy.

KiCheon.Lee · ‎10-22-2014

Hello. I want to make the following network-diagram. Is it possible? A Cisco Nexus Paloalto VRF-1 ----------------------> eth1/1.1 | 1.1.1.1 | VR : default | trust tag 10 | | VRF-2 <--------------------- eth1/1.2 | 2.2.1.1 | VR : default | untrust tag 20 1. Traffics go into sub-interface eth1/1.1 with tag 10. 2. FW process routing and policing. 3. Traffics go out from sub-interface eth1/1.2 with tag 20. Two sub-interfaces are on same physical interface. Thanks, KC Lee

KiCheon.Lee · ‎10-21-2014

Hello, I want to make custom application(or vulnerability) from MIME type. EXE of MIME Type is 'application/x-msdownload' So I made two customer applications as the following patterns. 1. application/x\-msdownload 2. \x61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 64 6f 77 6e 6c 6f 61 64\x But FW detected these custom applications which are tried to use many contexts. What did I mistook? What is wrong? Thanks, KC Lee

KiCheon.Lee · ‎09-24-2014

Hi hshah, Thanks you for your answer. are All WildFire signatures for PE made up w.generic??? And Is it possible that add range Virus IDs to virus exception? Regards, KC Lee

KiCheon.Lee · ‎09-22-2014

Hi ssharma, Thank your very much for your answer. It helps me so clear. Thanks, KC Lee

KiCheon.Lee · ‎09-22-2014

Thanks for your answer, Jacob and Hardik Shah. I already knew a way how to add a threat exception. But this method is I have to add each threat-IDs. My customer wants to add some automatic method. Do you know the ranged of w.generic virus signature IDs??? Thanks, KC Lee

KiCheon.Lee · ‎09-22-2014

Dear Steven, I have a question after have read your comment. We use a self-generated certificate with 2048 bits from FW for ssl outbound decryption. But we always see 1024 bits certificate when connecting to facebook. 2048 bits certificate can be generated by FW-self, but can not use to decryption. because FW does not support. Right? Thanks and Regards, KC Lee

KiCheon.Lee · ‎09-22-2014

Hello Roh, I have a question after have read your question. Can you input double-bytes on CLI window? I have nerver succeeded to input double-bytes on CLI. Please let me know how to input it. Thanks, KC Lee

KiCheon.Lee · ‎09-22-2014

Hello My customer think all w.generic virus signarues would have false-positive. So he want to make a virus profile excepted all w.generic signatures. Can it be made? Thanks.

KiCheon.Lee · ‎09-04-2014

Hi csharma, Thanks for your answer. It help me very useful. But my customer want to filter partial characters on many groups. Do you know another way excepted same group? We can not category group by partial characters. Thanks

KiCheon.Lee · ‎08-27-2014

Thanks for your answer, csharma. But we use xml method not AD with LDAP. In case, How should I use filtering? Thanks

KiCheon.Lee · ‎08-25-2014

Hello HULK, First, Thanks for your answer. I already looked above liked document. and I also tried to use "in SA" in the filter. But I could see nothing logs in traffic logs. In addition, PANOS is 5.0.10. Thanks

KiCheon.Lee · ‎08-25-2014

Hello, What difference are between 'user eq' and 'user in' in filter of traffic logs? I want to see output which is filtered by partial user-ID not full user-ID. For example, There are as below user-IDs. SA10001 SA10002 UQ20001 UQ20002 ....... I want to filter for all started 'SA' users in traffic logs. KC Lee

KiCheon.Lee · ‎08-06-2014

Hello, I have seen the below link and I have known FW can not decode Sliverlight about filename. Filenames of Hotmail Email Attachments do not Appear in the Data Filtering Logs So I want to know all kinds list which FW can decode for filename. Please let me know it. Thank you KC Lee

KiCheon.Lee · ‎07-08-2014

Hello, I am doing performance test with Breaking Point about throughput , CPS. While testing, I have found drop counters as below. session_dup_pkt_drop 701 3 drop session resource Duplicate packet: Applies only for multi-DP plat form with hardware (Tiger) broadcasting pkt to all DPs What does this mean??? KC Lee

KiCheon.Lee · ‎06-17-2014

OK, Kunal Adak. Thanks.

KiCheon.Lee · ‎06-17-2014

Hello, My customer made vulnerability signature in FW. But FW doesn't detect this signature. Customer Vulnerability Signature context : http-req-message-body pattern : eval\(gzinflate\(str_rot13\(base64_decode I am searching this but I don't know. So I need your assistance for it. I have read Creating_Custom_Signatures-RevA.pdf document This document describe as the following message. http-req-message-body Description: Body content of a HTTP request when the body content cannot be recognized as URL encoded or MIME type data using the Content-type field. Do you know to relate between not detecting signature and this description?? Thanks

KiCheon.Lee · ‎06-17-2014

Hello, My customer made vulnerability signature in FW. But FW doesn't detect this signature. Customer Vulnerability Signature context : http-req-message-body pattern : eval\(gzinflate\(str_rot13\(base64_decode I am searching this but I don't know. So I need your assistance for it. I have read Creating_Custom_Signatures-RevA.pdf document This document describe as the following message. http-req-message-body Description: Body content of a HTTP request when the body content cannot be recognized as URL encoded or MIME type data using the Content-type field. Do you know to relate between not detecting signature and this description?? Thanks

KiCheon.Lee · ‎06-10-2014

Thanks Roh. Your monitoring always gives me a scare. Anyway, I need a detail version. For example, 0.9.8p or 0.9.8za or etc.

KiCheon.Lee · ‎06-10-2014

Hello, What version is open SSL Library in PANOS 5.0.x???

KiCheon.Lee · ‎05-22-2014

Hello, I am creating custom application. I have been faced a problem. There are two URL below, http://live.sports.media.daum.net/cast/baseball/relay?game_id=71014605#text http://live.sports.media.daum.net/cast/baseball/relay?game_id=71014605#hdvod Both are baseball streaming-service. But one is text base streaming-service. The another is video base streaming-service. My customer want to allow text base streaming and block video base streaming. Can I create two custom application to identify http fragment(#text , #hdvod)? Thanks and Regards, KC Lee

KiCheon.Lee · ‎05-20-2014

Well, Why does a image file nee authentication??? Regards, KC Lee

KiCheon.Lee · ‎05-20-2014

HI Narong, Thank you so much. I searched this messages but I did not see the above document. It helps me very useful. Regards, KC Lee

KiCheon.Lee · ‎05-20-2014

Hi FW can no update anti-virus signature. Please look at the following logs. admin@PA-3050> request anti-virus upgrade install file panup-all-antivirus-1278-1748.tgz Content install job enqueued with jobid 4 4 admin@PA-3050> show jobs processed Enqueued ID Type Status Result Completed -------------------------------------------------------------------------- 2014/05/20 18:24:10 4 Install FIN FAIL 18:24:11 2014/05/20 18:20:01 3 Commit FIN OK 18:20:11 2014/05/20 18:16:38 2 Install FIN FAIL 18:16:40 2014/05/20 18:11:02 1 AutoCom FIN OK 18:11:32 admin@PA-3050> show jobs id 4 Enqueued ID Type Status Result Completed -------------------------------------------------------------------------- 2014/05/20 18:24:10 4 Install FIN FAIL 18:24:11 Warnings: Details:content update failed with the following messages: Image File Authentication Error Failed to extract rpm file /opt/pancfg/mgmt/av-images/tmp/panup-all-antivirus-1278-1748.tgz What do the above messages mean? What should I do for solution? Thanks KC Lee

Date Registered	‎04-29-2011 08:30 AM
Date Last Visited	‎11-01-2019 12:58 AM
Total Messages Posted	202
Total Likes Received	14

Online Status	Offline
Date Last Visited	‎11-01-2019 12:58 AM

Strata

Prisma

Cortex

About KiCheon.Lee