Introduction

Palo Alto has been considered one of the most coveted and preferred Next generation Firewall considering its robust performance, deep level of packet inspection and myriad of features required in enterprise and service provider domain. When troubleshooting network and security issues for many different devices/platforms, an extensive set of commands with options are available which are great utilities in troubleshooting and fault finding, both in implementation and Operations phase.

Palo Alto Troubleshooting : CLI Commands

The following Palo Alto commands are really the basics and need no further explanation. Let’s have a look on below command table with description.

CLI COMMANDS	DESCRIPTION
show system info	-Shows session information
show system environmental show CPU usage show temperature show counters for everything show the statistics on application recognition	-Shows environmental health of system
show ntp	-Shows the network time server information
show arp {all | <interface-name>} show neighbor interface {all | <interface-name>}	-shows the ARP results
show mac all	-shows the mac table results
show jobs all show jobs id <id> show running resource-monitor	-Shows the processes running in the management plane
show system resource show system disk-space	– Shows the percent usage of disk partitions
request restart system	– Restart the device
show admins all show admins	-Shows the how many admin accounts are
show the uptime and the active sessions	-Shows the device uptime
show running security-policy	– Shows the running security policy
request license info	– Shows the licenses installed on the device
show vpn gateway	-Shows the list of all IPSec gateways configured on device with configuration
show vpn ike-sa	-Shows IKE phase 1 SAs
show vpn ipsec-sa	-Shows IKE phase 2 SAs
show vpn tunnel	-Shows a list of auto-key IPSec tunnel configurations
show vpn flow	-Shows the IPSec counters
show global-protect-gateway current-user show global-protect-gateway flow	GlobalProtect
show high-availability all	-Shows a summary of all HA runtime
show high-availability state show high-availability link-monitoring show high-availability path-monitoring show high-availability control-link statistics show high-availability state-synchronization	-Shows a local HA peer state
show high-availability flap-statistics	Shows a stats of sent and received messages.
scp export log system to <username@host:path_to_destination_filename> scp import software from <username@host:path> tftp export configuration from running-config.xml to <tftp-host> tftp import url-block-page from <tftp-host>	Export/Import Files
show user group-mapping state all	User-IDs and Groups
request system fqdn {show | refresh}	IP Addresses of FQDN Objects
show dns-proxy statistics all show dns-proxy cache all	DNS Proxy
show system setting url-database	Active URL Vendor/Database
show system setting url-cache all	PAN-DB URL Test & Cache
set system setting fan-mode auto	Fan Speed
show session id <id>	Reason for Session Close
show session all filter state discard show session all filter application dns destination 8.8.8.8 show session info show specific session	Examining the Session Table
set system setting additional-threat-log on	Zone Protection Logging
view-pcap follow yes filter-pcap	Live Viewing of Packet Captures
tcpdump snaplen 0 filter “port 53” view-pcap follow yes mgmt-pcap mgmt.pcap	Capturing Management Packets
less mp-log	Viewing Management-Plane Logs
show routing table	-Display the routing table.
show routing fib show routing protocol <protocol>	-Look at routes for a specific destination
set system setting arp-cache-timeout <60-65536>	-Change the ARP cache timeout setting from default
show system setting arp-cache-timeout show routing path-monitor debug routing path-monitor	-View the ARP cache timeout setting
ping host X.X.X.X	-Ping to a destination IP address
traceroute host X.X.X.X	-Trace destination network
ping host ipwithease.com	-Ping fqdn
show netstat statistics	-Show network statistics
find command	Find
show system statistics application show system statistics session	Live Session ‘n Application Statistics
show interface {all | <interface-name>} show the interface state (speed/duplex/state/mac) show interface HW settings show interface zone settings show interface counters	Shows Interface Status and counters and config etc.
show running nat-policy	-Shows the NAT policy table
test nat-policy-match	-Test the NAT policy
show running ippool show running global-ippool	-Shows NAT pool utilization
show routing bfd active-profile [<name>]	Shows BFD profiles
show routing bfd details [interface <name>] [local-ip <ip>] [multihop] [peer-ip <ip>] [session-id] [virtual-router <name>]	Shows BFD details
show routing bfd drop-counters session-id <session-id>	-Shows BFD statistics on dropped sessions.
show counter global | match bfd	-Show BFD packets.i.e. transmitted/received/dropped.
clear routing bfd counters session-id all | <1-1024>	-Clear counters of transmitted, received, and dropped BFD packets for particular session id.
clear routing bfd session-state session-id all | <1-1024>	-Clear BFD sessions for debugging purposes
show vlan all   show counter global	-Verify vlan configured on device   – Shows the counter of times the PVST
show system info | match system-mode	-Display the current operational mode
request system system-mode logger	– Changes from Panorama mode to Log Collector mode
show device groups name	– Shows the history of device group
show templates name <template-name>	– Shows the history of template
show config pushed-shared-policy	– Shows all the policy rules and objects pushed from Panorama to a firewall
show config pushed-template	-Shows all the template configured from Panorama to a firewall
show logging-status device <firewall-serial-number>	– Shows logging information to the Panorama

Download the descriptive command table here.

Conclusion

Palo Alto Network troubleshooting CLI commands are used to verify the configuration and environmental health of PAN device, verify connectivity, license, VPN, Routing, HA, User-ID, logs, NAT, PVST, BFD and Panorama and others.

In case, you are preparing for your next interview, you may like to go through the following links-

Palo Alto Firewall Questions and Answers in PDF

Palo Alto Firewall Architecture

Also if you are reading more about Network Security and Firewall we also have a combo product covering the details of ASA Firewall, Palo Alto, Checkpoint Firewall, Juniper SRX Firewall, Proxy, CCNA Security, Cisco, IPS/IDS, VPN

Click here to buy the Network Security Combo