About yhlee1

Hello,   I have a FW that has many nat rules.   And I found a bug, pan-130550: ( PA-3200 Series, PA-5220, PA-5250, PA-5260, and PA-7000 Series firewalls ) For traffic between virtual systems (inter-vsys traffic), the firewall cannot perform source NAT using dynamic IP (DIP) address translation. Workaround:    Use source NAT with Dynamic IP and Port (DIPP) translation on inter-vsys traffic.   Mine is PA-5250 and I already have DIP NAT rules for inter vsys traffic, and it looks like working well(hit counts, log..)   Anyone knows about that bug? Does it impact on every traffic or sometimes FW cannot perform NAT?   The workaround of the bug not works for me, I can't convert every DIP NAT rule to DIPP in my FW... ... View more

Hello, I have small issue with snmp.   We're monitoring PA's interfaces via SNMP. Sometimes values are 0, so it causes 100% of interface usage.   Similarly, when I use cmd "show counter rate eth~", sometimes it shows 0. It happens when I execute cmd before 15 sec than previous cmd. Those two devices have same version 8.1 , but model is different(5020, 3220). Is this known issue or does anyone has same issue? ... View more

Hello,   Recently I got error below on PA 850 device(8.1.13) -User Group count of 1098 exceeds threshold of 1000   The log is straight forward, number of group is exceeding the limit, but I have some question.   1. I have one more device,PA-3220, which look same LDAP for group mapping(same configuration). I found article about this and it says FW has limitation for user group above 8.x and it's on all FW. But there is no same log on 3220, even it has same number of group,1098. Is the limit different via devices?   2. The log says number of group exceeding the limit, but FW still holds over 1000 user group. active)> show user group list | match Total Total: 1098   Is this log just alert? I don't know how FW can hold more than 1000 group if there is limit.     ... View more

Hello,   I'm planning to upgrade storage capacity M-500. It's using 12 slots with 1TB disks, I'm going to insert 2TB disks to empty slots and replace 1TB to 2TB.   As I know, after add new disks, panorama will redistribute existing logs. While that process, can I replace 1TB disk to 2TB?   Thanks ... View more

Hello,   I'm going to upgrade pa 5020 *2 and m 500 to 8.1.9 from 7.1.18.   My plan is: Upgrade 8.0.19 M-500 upgrade 8.0.19 passive upgrade 8.0.19 active upgrade 8.1.9 M-500 upgrade 8.1.9 passive  upgrade 8.1.9 active Log migration for M-500   My concern is when I upgrade M-500, stored log should be remain. Are the logs removed when upgrade panorama device? And Is it ok to do log migration after 8.1.9 upgrade is finished? How long does it take?(5TB log storage)     ... View more

Hello,   I was asked to export 3 month traffic logs.   I exported via gui but it has about 1 million lines and only contains less than a 1 day.   How can I export full 3 month traffic log in panorama M500? ... View more

Hello.   I'm trying to configure dual ISP and automatic IPSec tunnel failover. Network diagram looks like picture in here(https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFiCAK). And IPSec peer devices are Fortigate.   Not like above article, I didn't make two virual router and I use static route monitoring feature to primary route.   I'm thinking to use tunnel monitoring instead static route monitor.(because of rekey issue) Is it possble to use tunnel monitoring with Fortigate device? And can I just configure tunnel monitoring without making additional virtual router? ... View more