About JoeKwok

JoeKwok · ‎07-07-2022

Hi all, I found that when I Export PDF report of ACC application usage, the report cannot be displayed normally, it will be lack of colour of each application grid like below How can I solve it? Is it normal or not? Any document mention this?

JoeKwok · ‎06-29-2022

Hi All, Nowadays, HTTP/3 is announced which runs over QUIC and according to W3Techs HTTP/3 is used by 25.1% of all the websites. (on 29-Jun-22, https://w3techs.com/technologies/details/ce-http3) I would like to know that is HTTP/3 supported such as SSL Forward Proxy Mode from Palo Alto firewall? I cannot find any document mention HTTP/3 on Palo Alto Networks. Since I found that some load balancer such as F5 already support HTTP/3 for load balancing. I think it is similar principle for SSL Forward Proxy? https://support.f5.com/csp/article/K05822509 QUIC has a "connection ID" instead of traditional IP address used for load balancing Furthermore, cloudflare also claim that it support HTTP/3 inspection https://blog.cloudflare.com/cloudflare-gateway-http3-inspection/

JoeKwok · ‎06-13-2022

Thanks for reply. May I know any document mention "unknown-tcp" follows system defaults (Device > Setup > Sessions > Session Timeouts)? Since I found a case that timeout of "unknown-tcp" is still 3600 even the setting of system defaults was changed.

JoeKwok · ‎06-11-2022

May I know the updated link? There are "Access Denied" be shown when I click the link Thank you

JoeKwok · ‎05-19-2022

With the new feature - Advanced Threat Prevention in PAN-OS 10.2 There are Inline Cloud Analysis in PAN-OS 10.2 I found a new setup - Threat Prevention Inline Cloud Analysis under Device > Setup > Content-ID I would like to know what is the different with enable or not on "Allow on Max Latency". Is it means that exceed the Latency of Inline Cloud Analysis, the packet will be bypass or drop? enable means bypass or drop? Where can I find the document related to this? I take a look of below link, but no mention on this. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/device/device-setup-content-id

JoeKwok · ‎05-18-2022

Thanks for you reply. I can found some VPN client App-ID, but it seems like no NordVPN. Would you know the App-ID can block this VPN?

JoeKwok · ‎05-18-2022

Is it possible for Palo Alto Firewall to decrypt third party VPN agent traffic such as NordVPN, NordLynx like decrypt HTTPS web-browsing traffic? If it cannot decrypt these traffic, anyone know the App-ID for NordVPN, NordLynx? I found some VPN app-ID like ciscovpn, open-vpn but no Nord related. What App-ID should I use to block NordVPN, NordLynx?

JoeKwok · ‎05-18-2022

Thanks for your help. May I know any document such as Administrator’s Guide to provide more configuration information for this advanced section?

JoeKwok · ‎05-16-2022

Would you means you want to access current active firewall in same IP independent of which take a active? You can set a loopback interface and set it permits for management traffic. Since the passive firewall data-port will not turn on, you will always access to the current active firewall through that loopback interface IP. You may refer below link https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/configure-interfaces/use-interface-management-profiles-to-restrict-access

JoeKwok · ‎05-16-2022

Where can I know how to setup the application SLA condition? I read some Prisma SD-WAN Administrator’s Guide, I seen there are lot of function to enable Path selection and monitoring based on the Link Quality, SLA. But how can I set the SLA of the application such as Packet Loss, Jitter, and Latency? For example, I would like to setup access YouTube within 5ms Latency & 2ms Jitter, where can I defined these SLA? If I cannot define it, how can I know the application SLA of Prisma SD-WAN ?

JoeKwok · ‎05-13-2022

I am a bit confuse the "Data Filtering" and Enterprise Data Loss Prevention Is it "Data Filtering" is one of the function under "Threat Prevention Subscriptions"? Then what is the Enterprise Data Loss Prevention ? Can I still use the "Data Filtering" without " Enterprise Data Loss Prevention Subscriptions"? If I purchase " Enterprise Data Loss Prevention Subscriptions", can I used it in PA firewall directly without Panorama? The main different between "Data Filtering" and Enterprise Data Loss Prevention , is it local based filtering vs cloud analysis based filtering? When I using Enterprise Data Loss Prevention , will it upload my traffic file to PA-Cloud for analysis?

JoeKwok · ‎04-27-2022

May I know the result after contact support?

JoeKwok · ‎04-26-2022

Hi all, I am checking the log of firewall to know the states of firewall issue. I found that there are some log in ms.log as show below 2022-XX-XX XX:XX:XX.XXX +0800 update system boot: count = YYYY, timestamp = 2022/XX/XX XX:XX:XX What is the meaning of this log? Is it mean the dataplane reboot at 2022/XX/XX XX:XX:XX, total reboot number is YYYY? Where can I check the meaning of the log?

JoeKwok · ‎03-21-2022

I would like to know the setting detail on ADEM Application test Advanced Options. As I see there are ADVANCED NETWORK TEST OPTIONS with TCP-443 and ADVANCED WEB TEST OPTIONS with https as a default setting. What is the purpose of these setting? Any explanation document related to these options? For example, I would like to add a application test for non-SaaS application such as ms-rdp in internal network on ADEM. After input target IP and application (ms-rdp), should I change the ADVANCED NETWORK TEST OPTIONS to TCP-3389? Or I just keep it in default?

JoeKwok · ‎03-01-2022

Hi all, Is it any way to check the security policy hit count in Prisma Access (Cloud Management)? I only can see "Zero Hit Object" if the policy has no hit count, how about the total hit count value like in strata firewall?

Member Since	‎02-22-2021 07:10 PM
Date Last Visited	‎08-04-2022 05:29 AM
Posts	24
Total Likes Received	4

Online Status	Offline
Date Last Visited	‎08-04-2022 05:29 AM

About JoeKwok

ACC Export PDF of application usage lack of colour

Re: Chrome Quic SSL proxy / deep inspection

Re: unkown-tcp/udp session timeout?

Re: unkown-tcp/udp session timeout?

Threat Prevention Inline Cloud Analysis - Allow on Max Latency

Re: Decryption or blocking NordVPN

Decryption or blocking NordVPN

Re: Prisma SD-WAN application SLA setup?

Re: Management IP in Active/passive setup

Prisma SD-WAN application SLA setup?

Prisma Access (Cloud Management) Hit Count

Re: unkown-tcp/udp session timeout?

Re: Management IP in Active/passive setup

Re: DNS-base application

Re: Chrome Quic SSL proxy / deep inspection

ACC Export PDF of application usage lack of colour

Re: Chrome Quic SSL proxy / deep inspection

Re: unkown-tcp/udp session timeout?

Re: unkown-tcp/udp session timeout?

Threat Prevention Inline Cloud Analysis - Allow on Max Latency

Re: Decryption or blocking NordVPN

Decryption or blocking NordVPN

Re: Prisma SD-WAN application SLA setup?

Re: Management IP in Active/passive setup

Prisma SD-WAN application SLA setup?

Different between Data Filtering and Enterprise DLP

Re: WCCP visibility

meaning of ms.log - update system boot?

ADEM Application test Advanced Options

Prisma Access (Cloud Management) Hit Count

Unlock your full community experience!

About JoeKwok