About RohJaewoong

RohJaewoong · ‎07-29-2015

Hi Thanks for response. The counter named flow_fpga_rcv_err have been increased even if we don't have any threat prevention and data filter. Only APP-ID we've installed firewall. I think it is not expected behavior on firewall. Why my firewall works like what I mentioned? Thanks again Regards, Roh

RohJaewoong · ‎07-27-2015

Hi guys, Sometimes, the firewall has got a increasing drop counter simultaneously as following. "flow_fpga_rcv_err" - Packets dropped: receive error from offload processor packet drop : offload processor parse error I want to know it is expected behavior or not. If it is expected behavior, Please let me know in detail. Thanks. Regards, Roh

RohJaewoong · ‎04-10-2015

Hi guys. Nowadays I have got a project for installing PA7050 but I confused about the PA7050 how many security rule supported for PA7050. Several months ago, I checked the DataSheet and Compare tools of PA7050 that mentioned PA7050 supported 80,000 rules officially. For now the below link also mentioned that PA7050 can support 80,000 rules. What is the Maximum Number of Rule Objects Supported? However, For now compare tool showed that PA7050 supported only 40,000 rules and PA7050 box also said that supported 40,000 rule only via command "show system state | match policy". What is correct capacity of rules for PA7050 box? Supported 80,000? or 40,000 only? Anybody knows about that issue? Please let me know correct answer. Thanks. Regards, Roh

RohJaewoong · ‎11-27-2014

Hi JRussell, Thanks for answer. As you know that "Highlight unused rules" could show only Unused Rules after device started up. I and customer want to know exactly about Unused Rules for particular schedule such as 2 weeks or 1 month or custom schedule. I believe that the PaloAlto Firewall don't have feature about showing Unused Rules with particular time-frame. So it should be requested to PAN HQ as feature requesting by SE. Thanks! Regards, Roh

RohJaewoong · ‎11-26-2014

Hi guys, I have question about PaloAlto Custom Report. I can find that document for getting used rules with counter from customer report as How to Create Custom Report to Show The Least Used Rules in Security Policies But Customer want to know exactly UNUSED RULES WITH COUNTER from custom report. Is it possible? Customer really want to have that custom report can show entries of rule-name with no count. If not, I want to have feature request to PaloAlto HQ. Above is a sample of used rules with counter from custom report and that don't contain entry of unused rule with no repeat count. Thanks. Regards, Roh

RohJaewoong · ‎10-22-2014

Hi, I think it is possible to work because sub-interfaces are different interface logically with tag number. Thanks. Regards, Roh

RohJaewoong · ‎09-25-2014

Hi KC, You have to enable the scripting mode as below > set cli scripting-mode on > configure # set shared address korea-good description "노재웅짱짱맨" It is working as I expected Thanks. Regards, Roh

RohJaewoong · ‎08-26-2014

Hi cheon, I also tried to do test and it's available but not working. GOOD LUCK~

RohJaewoong · ‎07-13-2014

Hello guys, I have a issue about the IPsecVPN tunnel. One side of IPsecVPN tunnel is slow for receiving traffic but opposite side is OK to receiving traffic. flow_tunnel_activate 2 0 info flow tunnel Number of packets that triggerred tunnel activation flow_tunnel_decap_err 47373 0 drop flow tunnel Packet dropped: tunnel decapsulation error flow_tunnel_ipsec_replay_err 47372 0 drop flow tunnel Packet dropped: header sequence number is a replay flow_tunnel_ipsec_wrong_spi 1 0 drop flow tunnel Packet dropped: IPsec SA for spi in packet not found As you above that flow_tunnel_decap_err and flow_tunnel_ipsec_replay_err counter are being increased and I believe that dropped packet caused above counter that makes slow to tunneled traffic. I also disabled the option the replay protection on IPsecVPN configuration as below. But flow_tunnel_ipsec_replay_err counter is being increased for now even if anti-replay option disabled. <tunnel-monitor> <enable>no</enable> </tunnel-monitor> <anti-replay>no</anti-replay> <copy-tos>no</copy-tos> <tunnel-interface>tunnel.1</tunnel-interface> I cannot understand why above counter increasing and tunneled packet are being dropped. I read that similar case IPSec Tunnel is up but Packet is Getting Dropped with Wrong SPI Counter Increase but I cannot solve the my case. Anybody knows about this issue? if yes, Please let me know and help. Thanks. Regards, Roh

RohJaewoong · ‎07-03-2014

Hi Steven, My local se create that the FR and FR id is 3870. Please vote it Have a great day. Regards, Roh

RohJaewoong · ‎07-01-2014

Hi Hardik, Thanks for answer. I believe that it could improve PAN custom report feature if PAN accepted. I will request my local SE for feature request. Thanks again. Regards, Roh

RohJaewoong · ‎07-01-2014

Hi guys, My customer configured the Custom Report with enabled schedule so PAN automatically generated Custom Report and sending a Report to Customer Email address. It's a good work for us. Customer don't want the report that no data contained caused no matched data but PAN has sent a report that not to contained any matched data to customer email address. So I want to restrict sending report when generated report don't have valuable data. It's a possible? or not? If it be possible, Please let me know how do I set and configure the option for the Custom Report setting. Thanks in advance. Regards, Roh

RohJaewoong · ‎06-10-2014

Hi. PANOS have been used for OPEN SSL 0.9.8 and that has not vulnerability of Open SSL issue. But newer OpenSSL issue has got a problem of PAN and you should call and question your local SE and He can provide you proper information for the issue. I have been always monitoring for you on the PAN community. Thanks.

RohJaewoong · ‎05-13-2014

Hi, I'm not fried . I am always tracking for you write something on the KB or not. haha. Good day bro.

RohJaewoong · ‎05-12-2014

Hi, I hope it helps you. https://live.paloaltonetworks.com/message/28145#28145 Thanks. Regards, Roh

RohJaewoong · ‎04-23-2014

Hi tpiens, Thanks for detailed information about the question! Have a nice day! Regards, Roh

RohJaewoong · ‎04-23-2014

Hi guys, A session generated by override rule that can be applied rematch session after commit configuration successfully? Or not? I guess that rematch session would not impact to session generated by application override rule. Please let me know above question. Thanks. Regards, Roh

RohJaewoong · ‎02-06-2014

Hi Cheon, The PAN box said you have to change HA state to suspend and then it's possible to change URL-DB Bye. Regards, Roh

RohJaewoong · ‎02-03-2014

Hello HULK, Thanks for giving a information. Finally I created a no-decrypted rule with destination address and it's working fine. Have a nice day. Regards, Roh

RohJaewoong · ‎02-03-2014

Hello HULK, Thanks for giving information . It's a strongly needed information. But I have question remaining is how do I bypass the unsupported SSL traffic such as a SSL with using unsupported cipher-suite. Should I not assign the SSL decryption profile that makes bypass the unsupported SSL traffic? or how? I tried to find that URL for SSL handshaking but could not find. I believe that Ciper Suite : TLS_RSA_WITH_AES_256_CBC_SHA makes hiding URL for SSL handshaking, right? I am not sure. If I found that URL for SSL handshaking and recognizing URLs of SSL by PAN, I could make a no-decrypt rule but now I cannot do. Thanks. Regards, Roh

RohJaewoong · ‎02-03-2014

Hello knarra, Thanks for interesting my question. Yes, The decryption profile assigned to the decryption policy and I disabled the option "Block sessions with unsupported cipher suites" but it's not working to login for kakao-talk application. Thanks again. Regards, Roh

RohJaewoong · ‎02-03-2014

Hello guys. I have installed SSL decryption policy, which is forward proxy, for particular users. It's working fine but some problem occurred. Korean messenger application called kakao-talk for PC is not being able to login during forward-proxy SSL decryption policy applied. So I tried to capture the PCAPs for kakao-talk login function and they were using that TLS version 1.1 and Ciper Suite : TLS_RSA_WITH_AES_256_CBC_SHA (0x0035). I could not find that any document for unsupported cipher suite for forward proxy (outbound SSL decryption). My question is PAN could not support cipher suite, TLS_RSA_WITH_AES_256_CBC_SHA? How do I bypass for the unsupported cipher suite for outbound SSL decryption? I tried to create a decryption profile that not to enable any block policy but it could not be bypassed and kakao-talk was not able to login. Please let me know what is unsupported cipher suite for outbound SSL decryption and how can I bypass for unsupported outbound SSL decryption traffic. Thanks in advance. Regards, Roh

RohJaewoong · ‎01-21-2014

Hi panos, Thank you very much!!!! Have a nice day! Regards, Roh

RohJaewoong · ‎01-21-2014

Hello. This is PANOS 5.0.6 but problem occurred

RohJaewoong · ‎01-21-2014

Hello guys. I have a question about group membership of AD. What is exactly the maximum number of AD users per AD group on the Firewall? How much PAN recognize the maximum users per AD group from AD? There is no limit? or has limit? If it has a limit, Please let me know Thanks in advance. Regards, Roh

RohJaewoong · ‎01-21-2014

Hello guys. I have a question about group name could contain a special character such as & ! * from ActiveDirectory. I think it is not working properly if group name contained special character. Customer have using GlobalProtect with LDAP authentication from AD as a AD group and AD group has special character &. User could not be authenticated properly. Thanks. Regards, Roh

RohJaewoong · ‎12-19-2013

Hello guys 1. I configured LDAP profile and update from AD DC 2. AD group named domain-users has about 10900 user 3. Customer created new user and applied new user to domain-users group So I tried to refresh a group-mapping information by debug command. But PAN could not be updated domain-users group information and refreshing member of group. 1. I created new group and applied new user to new group PAN could be updated and bring a new-group with their membership. So I have a question. How many PAN recognize a group-member from AD? or PAN has got a limit of max group membership from AD? Thanks in advance. Regards, Roh

RohJaewoong · ‎12-04-2013

Hello Guys. I have a question about GlobalProtect. While a user is logged inn and running to GlobalProtect Gateway, Another user possible to log in to GlobalProtect Gateway with same USER-ID at the same time. I want to restrict that log-in to GP GW using same USER-ID at the same time. Can I possible to install with above things for a GP? Thanks. Regards. Roh

RohJaewoong · ‎11-15-2013

FYI LDAP Proxy cannot be enabled by USER-ID Collector I checked

RohJaewoong · ‎11-13-2013

Hello. I have a question. When using USER-ID Collector on Agentless Environment, LDAP Proxy can be enabled? or not? I believe that it is not working. If possible, Please let me know how do I configure or install that function. Thanks. Regards, Roh

Date Registered	‎05-09-2013 10:57 PM
Date Last Visited	a month ago
Total Messages Posted	57
Total Likes Received	15

Online Status	Offline
Date Last Visited	a month ago

Strata

Prisma

Cortex

About RohJaewoong