About KiCheon.Lee

Hi,   My FW is updated ip-user-mapping information from only A DC with a.com. A DC have been connecting Forest with B DC included b.com. Sometimes, The FW has been updated users in b.com domain from A DC. So I want to ignore to update user-ID from A DC for b\users, only allow a\users.   I have tried a way using ignore-list but I want to know a way better or just another. If you know them, I hope you will help me.   Thanks ... View more

Hello,   I don't understand why 'parent app' is. What is it used for? and When is it used? if I choose 'facebook-base' in parent app when I create 'ABC' of custom application, the 'ABC' application is inherited the signature from 'facebook-base'?   Honestly, I don't think it as above. I thought this setting is just information showed.   I hope to get advice from you.         ... View more

Hello,   I wathched strange logs. Hence I would like to get your help.   Please look at the following logs. PA missed 4 pings then restaring connection. So HA1 interface was down during 1 second. I remember take-over just happen after missed 4 pings. Probably, I have never seen the log for restarting connection. Was something on default behavior changed? OR I do not know something about HA.   Please let me know it.     2016-05-07 00:01:34.763 +0900 Error: ha_ping_peer_miss(src/ha_ping.c:756): Missed 1 ping timeouts out of 3 (ha1) 2016-05-07 00:01:35.763 +0900 Error: ha_ping_peer_miss(src/ha_ping.c:756): Missed 2 ping timeouts out of 3 (ha1) 2016-05-07 00:01:36.763 +0900 Error: ha_ping_peer_miss(src/ha_ping.c:756): Missed 3 ping timeouts out of 3 (ha1) 2016-05-07 00:01:36.763 +0900 Error: ha_ping_peer_miss(src/ha_ping.c:763): We have missed 4 pings from the peer for group 1 (ha1), restarting connection 2016-05-07 00:01:36.765 +0900 Warning: ha_event_log(src/ha_event.c:47): HA Group 1: HA1 connection down 2016-05-07 00:01:36.765 +0900 debug: ha_peer_send_error(src/ha_peer.c:1641): Group 1 (HA1-MAIN): Sending errro message Error Msg --------- flags : 0x2 (close:) err code : Heartbeat ping failure (16) num tlvs : 1 Printing out 1 tlvs TLV[1]: type 5 (ERR_STRING); len 23; value: 48656172 74626561 74207069 6e672066 61696c75 726500 2016-05-07 00:01:36.765 +0900 Error: ha_peer_disconnect(src/ha_peer.c:1776): Group 1 (HA1-MAIN): peer connection error msg set: Heartbeat ping failure 2016-05-07 00:01:36.765 +0900 Group 1 (HA1-BKUP): new primary (error), going away from NONE 2016-05-07 00:01:36.765 +0900 Warning: ha_event_log(src/ha_event.c:47): HA Group 1: Control link running on HA1-Backup connection 2016-05-07 00:01:36.765 +0900 debug: ha_peer_send_primary(src/ha_peer.c:5292): Group 1 (HA1-BKUP): Sending primary message ... View more

Hello,   I have questions. I know throuhput performance is half when using Threat Prevention.   If we would use only url filtering, how is PA's throughput performance? Is it same when using TP or only using application? And If we would use only file blocking, how about?   I think if url-filtering and file-blocking use signature-match-chip, it would be same when using TP. if they do not use signature-match-chip, it would be same when using only application.   Please let me know it.   Thanks, KC Lee          ... View more

Hello   My customer use two M-100s.  One is used to Panorama and another is used to log-collector. I upgraded two M-100s from 6.0.9 to 6.1.10. I used manual upgraded way because environment what can not access to internet. 1. panorama was upgraded to 6.1.0 manual. 2. panorama was upgraded to 6.1.10 manual 3. log-collector was upgraded to 6.1.0 manual. using 'device deployment' menu 4. log-collector was upgraded to 6.1.10 manual. using 'device deployment' menu   I tried to reboot 4 times on for two M-100s. But there was no FSCK perfoming. never. Uptimes were  over 380 days. I expected M-100s must perform FSCK two times.   why did not M-100s perform FSCK? Because log collector environment? or manual upgrade?   Please let me know it.   ... View more

Hello,   I have some questions about url-block-cache. I use continue action on url-filtering. URL Contiunue Time is set 12 hours.   1. HA is Active-Active on L3. It seems to no share url-block-cache between peers. Each results is different from "show system setting ctd url-block-cache" command. Right?   2. How many can PA have on url-block-cache? If url-block-cache was full, What will FW get a action?   3. I woudl like to know how to clear url-block-cache only one. Without "debug dataplane reset ctd block-url-cache" because this command is for all of url-block-cache.   I am facing the problem that some users is sometimes experencing "Web page is timeout" only continue custom category after they clicked continue button.           ... View more