About ttongfly

ttongfly · ‎12-26-2012

Hello guys. I could not find any information of multicast processing on layer 2 mode for PAN. I wonder about that how do PAN deal with multicast traffic such as HSRP, VRRP and OSPF (that use multicast addressing) on layer 2 mode. I believe that PAN would bypass and forward multicast traffic but I'm not sure. Please answer me above question. Thanks Regards, Roh

ttongfly · ‎11-28-2012

Hello guys, I want to install a PBF rule with custom application. Is it possible to configure on PAN? Thanks. Regards, Roh

ttongfly · ‎11-25-2012

Hello, Would TLS 1.1 and 1.2 be decrypted by PANOS 5.0 for now? TLS 1.1 with differ hellman could no be decrypted on PANOS 5.0 also? Thanks. Regards. Roh

ttongfly · ‎10-18-2012

Hello, You should enable option "Enable X-Auth Support" and Group name and pass-word also should be configured. For iPad, You should configure VPN selected IPSEC (Cisco) and then configured Group name and password you configured on GP GW. Finally, You can connect using iPAD and iPhone to GP GW using particular credencial. PANOS 4.1.6 above that support X-Auth, pre-shared key and Android Platform also. Thanks. Regards, Roh

ttongfly · ‎07-04-2012

Hello mikand, Thanks for reply. As you wrote "insufficient-data' means that is not enough data packets for identifying the application. I think insufficient-data, not to be identified app-id, was undecided application on session browser. However in my case, UNDECIDED traffic had got so many packets and data exceed over about 1.3GB on session browser. Its traffic could be insufficient-data? I suspect that. When captured PCAPs, the traffic was recognized NFS protocol on wireshark. Thanks. Regards. Roh.

ttongfly · ‎07-03-2012

Hello guys. I have some question about APP-ID. For session browser, PAN recognized application was UNDECIDED and traffic was passed and state was ACTIVE. so traffic was not dropped but why PAN could not recognized application properly and recognizing UNDECIDED that means PAN could not identified APP-ID for its traffic. 1. Why PAN could not recognized properly app-id and session browser showed app-id was UNDECIDED? 2. What is UNDECIDED mean exactly on session browser? 3. UNDECIDED application traffic has got a so many packets (of course this traffic over the 7 packets that could do identifying app-id) and bytes. so I think PAN should recognize this traffic as a proper app-id. Please let me know why did PAN recognize UNDECIDE as a app-id on session browser. Thanks. Regards. Roh.

ttongfly · ‎06-21-2012

Hello PAN would retrieve the license from PAN license server via MGT interface is default. 1. checking MGT interface could access the internet 2. checking MGT interface could look up a domain name for PAN license server. (google DNS server 8.8.8.8 and 8.8.4.4 is best I think) Thanks. Regards. Roh.

ttongfly · ‎05-31-2012

Hi notleyhigh. PAN device would access update-server using MGT interface is default. You should check that your MGT that access the internet or look up a DNS server that you configured or connect updates.paloaltonetworks.com. Thanks. Regards. Roh.

ttongfly · ‎05-31-2012

Hi mikand. The max capacity of SSD is 192.48GB (Used 182.86 + Free 9.62 = 192.48GB) is diffrent from 188.82GB (198G/1.024/1.024) that showed CLI. I guess SSD max capacity should be 188.82GB but 192.48GB using calculating 1000 and 1024 as factor. Why SSD max capacity is 192.48GB and not 188.82GB? I wonder about one more about SSD. SSD is 240GB but it showed from CLI is 215GB as below /dev/md3 = 3.8G ( / partition) /dev/md5 = 7.6G ( /opt/pancfg partition) /dev/md6 = 3.8G ( /opt/panrepo partition) /dev/md8 = 198G (/opt/panlogs partition) 3.8G + 7.6G + 3.8G + 198G = total 215GB Umm. SSD is 240GB but CLI showed only 215GB. where is 25GB? I guess, Somtimes SSD is using the space for over-provisioning that makes it less than total storage capacity. The SSD 240GB model that PAN has used is also applied over-provisioning space? so I could not find that 25GB? Please let me know how do PAN used over-provisioning space if PAN SSD be applied it. Please verify this case. Thanks. Regards. Roh.

ttongfly · ‎05-31-2012

Hi Guys. My customer have using SSD 240GB on PA5060 device and disk info is below As you see above, CLI showed Log parttition is 198G and WEB-UI is 192.48GB. so I try to calculate but result is 198G /1.024/1.024 = 188.82GB. is not same 192.48 GB from log parttion size of WEB-UI. SSD disk space to calculate is diffrent from SATA DISK of PA2000, PA4000 or PA500 series? Please answer me above Thanks.

ttongfly · ‎05-30-2012

Hi As Ameya mentioned, when configured IPSEC VPN and SSLVPN with Active-Active, Only floating IP can be used in this sceinario.

ttongfly · ‎05-10-2012

Hello guys As you know that PAN could show a release date of contents as below. I wonder about above date is related timezone configured PA box or only US/Pacific time? Thanks.. Regards. Roh.

ttongfly · ‎05-09-2012

Hello guys. As you know that PAN has got a option of session that non-syn-tcp. I have a question about non-syn-tcp. When reject non-SYN first packet was false (when non-syn-tcp was not dropeed) and non-syn-tcp session already establised throught PAN device If non-syn-tcp option were changed to true that makes drop session that established non-syn-tcp session? If it used command of configureation mode "set deviceconfig setting session tcp-reject-non-syn yes | commit", that makes drop also established non-syn-tcp session? Thanks. Regards. Roh.

ttongfly · ‎04-20-2012

HI mikand Customer has running PANOS 4.0.10 and could not make custom app-id for ICMP as you discussed. I think should be waited for next threat update to add traceroute app-id Thanks for kind answer! Have a good day. Regards. Roh.

ttongfly · ‎04-19-2012

Hi guys. I found that traceroute APP-ID on Applipedia web-site as below So I updated newest signature of Application and Threat that version to my PA box is 303-1361 (2012/04/17) but I could not find the traceroute APP-ID on my box. Why it is deffrent between newst signature and applipedia app-id list? When do I use the traceroute app-id? Thanks. Regards. Roh.

ttongfly · ‎03-27-2012

Thank you for answer. Have a nice day!

ttongfly · ‎03-27-2012

Hello guys. I noticed that log partition was different of same PAN device. CLI command that showed as below and log partition is max 125G. ttongfly@PA-500-UQUEST> show system disk-space Filesystem Size Used Avail Use% Mounted on /dev/sda2 3.8G 1.2G 2.5G 32% / /dev/sda5 7.6G 3.7G 3.5G 52% /opt/pancfg /dev/sda6 3.8G 2.6G 1005M 73% /opt/panrepo tmpfs 487M 37M 451M 8% /dev/shm /dev/sda8 125G 24G 95G 21% /opt/panlogs But Web-UI showed log partition is max 119.13GB Why above is diffrent size between CLI and WEB-UI?? Thanks. Regards. Roh.

ttongfly · ‎03-26-2012

Hi guys. I experienced PAN SSLVPN with Pinsafe OTP that support PaloAlto SSLVPN. PAN SSLVPN configured authentication profile using radius protocol to communicate Pinsafe OTP. NordicEdge OTP could support 2 factor authentication. When user try to connect SSLVPN of PAN, SSL VPN portal asked AD login id and password authentication and then asked OTP passcode authentication. PinSafe OTP also could support above function, 2 factor authentication, and I was done successfully integrated PAN SSLVPN. Thanks. Regards. Roh.

ttongfly · ‎01-17-2012

Hello jdelio I tested again and then PBF was worked properly for IPsecVPN traffic and missed configuration when PBF not to do. Thanks. Regards. Roh.

ttongfly · ‎01-15-2012

Hello. I want to know about PAN admin account performance. First. How many PAN support Admin account? Is it different from each PAN model? Second. How many PAN support concurrrent logged Admin user? Please let me know above question. Thanks in advance. Regards. Roh.

ttongfly · ‎01-12-2012

Hello guys. I have a question about IPSEC VPN tunnel and is IPSEC VPN can use PBF instead of routing or not. I think that tunnel interface could have ip-address (for tunnel monitoring) so I guess IPSEC VPN tunnel could use PBF instead of routing?! So I tested about that but its faild. so I wonder about it caused my missed configuration or PAN could not support IPSEC VPN with PBF. Please let me know above question. Thanks. Regards. Roh.

ttongfly · ‎12-07-2011

Thank you for reply in detailed informaiton.!!!!

ttongfly · ‎12-07-2011

Hello I have experienced this issue on lower PANOS 4.0.x that makes fail-over and occurred HA split brain issue. It was occurred also when HA backup link configured phsycally and HA backup option configured. I finally cleared this issue after upgrade PANOS 4.0.6 I guess this is critical issue on lower PANOS 4.0.x and suggest to upgrade PANOS higher version on 4.0.x. Thanks. Regards. Roh.

ttongfly · ‎12-04-2011

Hello You can use CLI command as below tftp export stats-dump start-time equal 2011/11/15@00:00:00 end-time equal 2011/12/05@00:00:00 to YOUR_PC_IP_ADDR that makes change time-frame for creating stats-dump. As you know also, Your PC must able to run TFTP daemon. Thanks. Regards. Roh

ttongfly · ‎12-04-2011

Hello. I checked our PA box that PA 5000 series and old one that have diffrent hard-disk for logging is below. - PA 5020 admin@PA-5020> show system disk-space Filesystem Size Used Avail Use% Mounted on /dev/md3 3.8G 1.3G 2.4G 34% / /dev/md5 7.6G 2.0G 5.2G 28% /opt/pancfg /dev/md6 3.8G 984M 2.7G 27% /opt/panrepo tmpfs 1.8G 37M 1.7G 3% /dev/shm /dev/md8 88G 4.8G 79G 6% /opt/panlogs - PA-500 admin@PA-500-UQUEST> show system disk-space Filesystem Size Used Avail Use% Mounted on /dev/sda3 3.8G 1.2G 2.5G 32% / /dev/sda5 7.6G 3.5G 3.8G 49% /opt/pancfg/dev/sda6 3.8G 1.8G 1.9G 49% /opt/panrepotmpfs 487M 37M 451M 8% /dev/shm/dev/sda8 125G 13G 106G 11% /opt/panlogs As you see above, PA-5020 has got the 88G logging partition and PA-500 series has got 125G logging partition. Why above is different? I want to know why is diferent in detail. Thanks Regards. Roh.

ttongfly · ‎11-10-2011

Hello guys. I experienced increasing constantly counter "url_request_pkt_drop" when installed PAN to customer. PAN showed that counter means "the number of packets get dropped because of waiting for url category request" So I think that means simply packet dropping related URLs when not resolved URLs. I guess packet dropping of URLs that makes problem connecting and browsing particular web. right? I want to know above counter why increase and when increase and what effect to customer's network. Thanks. Regards. Roh.

ttongfly · ‎11-10-2011

Hello rkalugdan Thank you for kind answer! Regards. Roh

ttongfly · ‎11-03-2011

Hi guys. I have question about APP-ID that ICMP and PING. I found that some document said "ICMP is all of icmp procol and PING is only ICMP type 0 and 7 is echo request and reply". When we have white list security policy, For open a PING application, Shoud we open ICMP and PING also? I think they has got app-dependency so ICMP must be opend and also ping should be opend. right? Thanks. Regards. Roh.

ttongfly · ‎10-08-2011

Thank you for reply But additional question about Custom URL category could be also accepted them?

ttongfly · ‎10-06-2011

Hi I think it is impossible but am wondering about that. for example. www.naver.com:8080/aaa/* (within port number on URL) is above is possible on url filter of PA? Thanks. Regards. Roh.

Date Registered	‎05-30-2010 06:48 PM
Date Last Visited	‎08-18-2015 09:06 AM
Total Messages Posted	76
Total Likes Received	6

Online Status	Offline
Date Last Visited	‎08-18-2015 09:06 AM

Strata

Prisma

Cortex

About ttongfly