About KiCheon.Lee

Hello. I am seeing data-filtering logs for wildfire and have found some logs. It is pdf file log that action is forward. Wildfire configuration is any application and action forward. But PDF is not PE file. I don't understand Why pdf file action is forward. forward Data plan detected a PE file on a WildFire-enabled policy.  The PE file is buffered in management plane. At this point, if you only see "forward" for a specific file, then that means it is either signed by a trusted file signer, or it is a benign sample that the cloud has already seen.  In either case, no further action is performed on the file, and no further information is sent to the cloud (not even session information is sent for previously seen benign files).  This means that you will not see an entry in the WildFire web portal for these files. I think reason that the data plan detected any file on a wildfre-enabled policy and the any file is buffered in management plan because wildfire configuration is any file. Right? I know only PE file was forward when wildfire configuration is any file. Thanks. ... View more

Hello I have made qos configuration. I have questions when am checking qos. Look at the following command show qos interface ethernet1/1 hw-counter qid   name                 pass bytes       WRED drop   policing drop -------------------------------------------------------------------------------- 0     default              3408809811               0               0 -2    bypass              14803984933          584640               0 I don't know what WRED drop and policing drop mean and what two counters are difference. ... View more

Hello, I have seen ez pid on cli output result of show session id xxx. What is the ez pid? Thanks ... View more

Hello, My customer is installing  video conference hardware. The video and voice traffics are normal from internal to external (internet). This mean is Internal user call external user. But Internal user doesn't see external user video when external user call internal user. I had checked NAT rules and security policy rules. It is no problem. So I did filtering and capturing in packet-capture. Many UDP traffics were dropped by 'forwarded to different zone' Routing configuration is no problem and PBF isn't used. And I had checked sessions on session-browser when external user call internal user. I had seen wrong sessions. There are sessions from captive-portal zone to captive-portal zone on session browser. Captive-portal isn't used and There is not captive-portal named zone in zones. I don't understand why this situation occurred. Please someone help me. ... View more

Hello, I have issue about Global Protect. So I want to downgrade Global Protect Agent. Does Global Protect Agent downgrade automatically on transparent mode? I have tested result for one PC what doesn't downgrade automatically, right? Thanks ... View more