About KiCheon.Lee

Hello, We are migrating configuration from juniper FW to paloalto FW. My customer used nine snmp trap servers on juniper FW. But paloalto FW cann't have over five snmp trap servers. Could you know other resolved ways? Please let me know it. Thanks ... View more

Hello I knew session owner generate traffic log. Does session setup device generated traffic log  If a session is denied L4 processing before L7 processing??? Network Diagram Router#1(Power-OFF) ------ Router#2(Power ON)             |                                       |           FW#1                               FW#2            |                                       |          BB#1                                BB#2 *Router#1 has problem. So It is power-off status. FW configuration Session owner : first-packet Session setup : ip-modulo rule01 on security rule : source zone = untrust , source IP = any , destination zone = trust , destination IP = 192.168.1.1 , service = any , application = any , action = deny. If rule01 actions is allow, there are rule01 traffic logs in only FW#2 because is session owner. Of course, session setup is load-sharing between FW#1 and FW#2. But rule01 action is deny and I have seen there are denied traffic logs in all FWs. So I think session setup device can generate traffic logs. Is it TRUE?? Please anybody know me! Summary. Some traffics go to FW#1 through FW#2 and across HA3 Link for session setup. Another traffics stay FW#2 for session setup. But these traffics are denied by rule01 during L4 processing before L7 processing. So There are denied traffic logs in all FWs. Thanks. ... View more

Hello FW tust interface don't reply to traceroute. traceroute reply traffic drop by 'ip ttl reaches zero' drop count. what cli command to allow does 'ip ttl reaches zero' drop count ?? ... View more

Hello, I failed to install FWs to custom. The FW was L3 mode with two interface(untrust , trust). When I installed inline, from untrust traffic did not go through to trust. Destination IP was just trust zone. In addition, FW did not have nat , vpn and protection configurations and security police was allow. At that time, I found out strange traffic logs and global counters. This traffic logs was source zone untrust , destination zone untrust , action allow , packet-received 897K and packet-sent 0. Destination IP was included trust zone. but destination zone was utrust. Also, 'no destination zone from forwarding' counter on global counters was increasing too many. Please somebody help me for explain this traffic log and this counter. Thanks. ... View more

I am glad to meet you. Some users was done time-out on global protect. The tunnel was expired. But GP Agent status was ‘connected’ not ‘not connected’. Why was not the connection status on global protect agent changed from 'connected' to 'not connected'?? Please look at the attached file. And PANOS is 4.1.15 with GP agent 1.2.6. Thanks. ... View more