About RohJaewoong

RohJaewoong · ‎04-23-2014

Hi tpiens, Thanks for detailed information about the question! Have a nice day! Regards, Roh

RohJaewoong · ‎04-23-2014

Hi guys, A session generated by override rule that can be applied rematch session after commit configuration successfully? Or not? I guess that rematch session would not impact to session generated by application override rule. Please let me know above question. Thanks. Regards, Roh

RohJaewoong · ‎02-06-2014

Hi Cheon, The PAN box said you have to change HA state to suspend and then it's possible to change URL-DB Bye. Regards, Roh

RohJaewoong · ‎02-03-2014

Hello HULK, Thanks for giving a information. Finally I created a no-decrypted rule with destination address and it's working fine. Have a nice day. Regards, Roh

RohJaewoong · ‎02-03-2014

Hello HULK, Thanks for giving information . It's a strongly needed information. But I have question remaining is how do I bypass the unsupported SSL traffic such as a SSL with using unsupported cipher-suite. Should I not assign the SSL decryption profile that makes bypass the unsupported SSL traffic? or how? I tried to find that URL for SSL handshaking but could not find. I believe that Ciper Suite : TLS_RSA_WITH_AES_256_CBC_SHA makes hiding URL for SSL handshaking, right? I am not sure. If I found that URL for SSL handshaking and recognizing URLs of SSL by PAN, I could make a no-decrypt rule but now I cannot do. Thanks. Regards, Roh

RohJaewoong · ‎02-03-2014

Hello knarra, Thanks for interesting my question. Yes, The decryption profile assigned to the decryption policy and I disabled the option "Block sessions with unsupported cipher suites" but it's not working to login for kakao-talk application. Thanks again. Regards, Roh

RohJaewoong · ‎02-03-2014

Hello guys. I have installed SSL decryption policy, which is forward proxy, for particular users. It's working fine but some problem occurred. Korean messenger application called kakao-talk for PC is not being able to login during forward-proxy SSL decryption policy applied. So I tried to capture the PCAPs for kakao-talk login function and they were using that TLS version 1.1 and Ciper Suite : TLS_RSA_WITH_AES_256_CBC_SHA (0x0035). I could not find that any document for unsupported cipher suite for forward proxy (outbound SSL decryption). My question is PAN could not support cipher suite, TLS_RSA_WITH_AES_256_CBC_SHA? How do I bypass for the unsupported cipher suite for outbound SSL decryption? I tried to create a decryption profile that not to enable any block policy but it could not be bypassed and kakao-talk was not able to login. Please let me know what is unsupported cipher suite for outbound SSL decryption and how can I bypass for unsupported outbound SSL decryption traffic. Thanks in advance. Regards, Roh

RohJaewoong · ‎01-21-2014

Hi panos, Thank you very much!!!! Have a nice day! Regards, Roh

RohJaewoong · ‎01-21-2014

Hello. This is PANOS 5.0.6 but problem occurred

RohJaewoong · ‎01-21-2014

Hello guys. I have a question about group membership of AD. What is exactly the maximum number of AD users per AD group on the Firewall? How much PAN recognize the maximum users per AD group from AD? There is no limit? or has limit?If it has a limit, Please let me know Thanks in advance. Regards, Roh

RohJaewoong · ‎01-21-2014

Hello guys. I have a question about group name could contain a special character such as & ! * from ActiveDirectory. I think it is not working properly if group name contained special character. Customer have using GlobalProtect with LDAP authentication from AD as a AD group and AD group has special character &. User could not be authenticated properly. Thanks. Regards, Roh

RohJaewoong · ‎12-19-2013

Hello guys 1. I configured LDAP profile and update from AD DC 2. AD group named domain-users has about 10900 user 3. Customer created new user and applied new user to domain-users group So I tried to refresh a group-mapping information by debug command. But PAN could not be updated domain-users group information and refreshing member of group. 1. I created new group and applied new user to new group PAN could be updated and bring a new-group with their membership. So I have a question. How many PAN recognize a group-member from AD? or PAN has got a limit of max group membership from AD? Thanks in advance. Regards, Roh

RohJaewoong · ‎12-04-2013

Hello Guys. I have a question about GlobalProtect. While a user is logged inn and running to GlobalProtect Gateway, Another user possible to log in to GlobalProtect Gateway with same USER-ID at the same time. I want to restrict that log-in to GP GW using same USER-ID at the same time. Can I possible to install with above things for a GP? Thanks. Regards. Roh

RohJaewoong · ‎11-15-2013

FYI LDAP Proxy cannot be enabled by USER-ID Collector I checked

RohJaewoong · ‎11-13-2013

Hello. I have a question. When using USER-ID Collector on Agentless Environment, LDAP Proxy can be enabled? or not? I believe that it is not working. If possible, Please let me know how do I configure or install that function. Thanks. Regards, Roh

Member Since	‎05-09-2013 10:57 PM
Date Last Visited	‎08-10-2020 01:21 PM
Posts	57
Total Likes Received	15

Online Status	Offline
Date Last Visited	‎08-10-2020 01:21 PM

About RohJaewoong

Re: What's mean for counter "flow_fpga_rcv_err" ?

What's mean for counter "flow_fpga_rcv_err" ?

How many security rule supported for PA7050?

Re: Can I get a entries of Unused Rules with no repeat count from Custom Report?

Can I get a entries of Unused Rules with no repeat count from Custom Report?

Re: Is it possible that traffics go on each other sub-interfaces with same physical interface?

Re: Could I use a Asian 2 bytes charset on CLI when I configure?

Re: What difference are between 'user eq' and 'user in' in filter of traffic logs?

Some VPN packet is being dropped and particular counter increased and traffic slow.

Re: About custom report with no matched data

About Syslog over TCP for PaloAlto Firewall.

Re: Questioning about unsupported cipher suite for SSL Decryption

Re: tunnel interface in PBF rule

Re: Is it possible that traffics go on each other sub-interfaces with same physical interface?

Re: About a session generated by override rule

Re: Could I use a Asian 2 bytes charset on CLI when I configure?

Re: About a session generated by override rule

Re: Not switch url-filtering vendor from brightcloud to pan-db in panos 6.0.0

Re: Not switch url-filtering vendor from brightcloud to pan-db in panos 6.0.0

Re: How can I edit group entry or delete group using xml-api?

Re: About a session generated by override rule

About a session generated by override rule

Re: Not switch url-filtering vendor from brightcloud to pan-db in panos 6.0.0

Re: Questioning about unsupported cipher suite for SSL Decryption

Re: Questioning about unsupported cipher suite for SSL Decryption

Re: Questioning about unsupported cipher suite for SSL Decryption

Questioning about unsupported cipher suite for SSL Decryption

Re: What is the maximum number of AD users per AD group?

Re: About group-name contains special character

What is the maximum number of AD users per AD group?

About group-name contains special character

About updating AD group membership

Can we possible to restrict another user log-in to GP using same USER-ID at the same time?

Re: About LDAP Proxy with User-ID Collector.

About LDAP Proxy with User-ID Collector.

Unlock your full community experience!

About RohJaewoong