When troubleshooting network and security issues on many different devices I always miss some command options to do exactly what I want to do on the device I am currently working with. Therefore, I list a few commands for the Palo Alto Networks firewalls to have a short reference for myself. Maybe some other network professionals will find it useful.

However, since I am almost always using the GUI this short reference only lists commands that are useful for the console while not present in the GUI.

This blog post will be a living document. Whenever I use some “new” commands for troubleshooting issues, I will update it. If there are any useful commands missing, please send me a comment!

For a complete list of all CLI commands, use the CLI Reference Guides from PAN. Or use the official Quick Reference Guide: Helpful Commands PDF.

Standard Show Commands

The following commands are really the basics and need no further description. I list them just as a reference:

 

Find

Since PAN-OS 6.0, the “find” command helps searching for the needed command in case you do not fully know the whole set of commands. With “find command”, all possible commands are displayed. With “find command keyword xyz”, all commands containing “xyz” are shown.

Ping, Traceroute, and DNS

A standard ping command looks like that:

Note that this ping request is issued from the management interface! To use a data interface as the source, the option source <ip-address>  can be used. To use IPv6, the option is inet6 yes . For example:

A traceroute command looks like that:

The source <ip-address>  can be used to specify the outgoing interface. However, for IPv6, the option is dissimilar to the ping command: ipv6 yes .

To resolve DNS names, e.g., to test the DNS server that is configured on the management interface, simply ping a name:

Test

The Palo offers some great test commands, e.g., for testing a route-lookup, a VPN connection, or a security policy match. Use the question mark to find out more about the test commands. Here are some useful examples:

Viewing Management-Plane Logs

In order to view the debug log files, “less” or “tail” can be used. The keyword “mp-log” links to the management-plane logs (similar to “dp-log” for the dataplane-logs). The tail command can be used with “follow yes” to have a live view of all logged messages. And as always: Use the question mark in order to display all possibilities.

Examples:

Capturing Management Packets

To view the traffic from the management port at least two console connections are needed. The first one executes the tcpdump command (with “snaplen 0″ for capturing the whole packet, and a filter, if desired),

while the second console follows the live capture:

Test traffic can be generated with a third console session, e.g.:

Later on, the pcap file can be moved to another computer with the following command:

Alternatively, tftp can be used:

Live Viewing of Packet Captures

When using the Packet Capture feature on the Palo Alto, the filter settings can easily be made from the GUI (Monitor -> Packet Capture). These settings as well as the current size of the running packet capture files can be examined with:

Now, the current capturing in follow mode can be viewed with:

And for a really detailed analysis, the counters for these filtered packets can be viewed. This exactly reveals how many packets traversed which way, and so on. With the “delta yes” option, only the counter values since the last execution of this command are shown. The “packet-filter yes” option uses the packet filter from the GUI (Monitor -> Packet Capture) to filter the counters:

For example, here are the delta counters after a few DNS lookups:

Or, even more interesting, filtered on “drop” severity. (Note the reasons on the right-hand side):

Examining the Session Table

If a network connection failure is not found in the traffic log, the session table can be asked for sessions in DISCARD state, filtered based on its source, or whatever. This is useful at the console because the session browser in the GUI does not store the filter options and is therefore a bit unhandy. All commands start with “show session all filter …”, e.g.:

To see whether there are some “predict” sessions in which the Palo Alto uses a ALG (appliation layer gateway) to predict dynamic ports (e.g., SIP, active FTP), use this command:

A specific session can then be cleared with:

Reason for Session Close

You cannot see the reason for a closed session in the traffic log in the GUI. For this purpose, find out the session id in the traffic log and type in the following command in the CLI (Named the “Session Tracker“). Note the last line in the output, e.g. “tracker stage firewall : Aged out” or “tracker stage firewall : TCP FIN”. This shows what reason the firewall sees when it ends a session:

Alternatively, the traffic log on the CLI can display the session tracker when used with the option “show-tracker equal yes” such as:

VPN Issues

(Palo Alto: How to Troubleshoot VPN Connectivity Issues). Though you can find many reasons for not working site-to-site VPNs in the system log in the GUI, some CLI commands might be useful. To reveal whether packets traverse through a VPN connection, use this: (it shows the number of encap/decap packets and bytes, i.e., the actual traffic flow)

Or use the counter values for ipsec issues:

And for a detailled debugging of IKE, enable the debug (without any more options)

then follow the pcap with

and do NOT forget to set the debugging off!

The complete ikemgr.pcap can be downloaded from the Palo with scp or tftp, e.g.:

Displaying the Config in Set Mode

The XML output of the “show config running” command might be unpractical when troubleshooting at the console. That’s why the output format can be set to “set” mode:

Now, enter the  configure  mode and type show . This reveals the complete configuration with “set …” commands. Here is a sample output of a particular show command:

The pipe (|) can be used to grep certain values with the “match” keyword, such as:

To show the complete config without breaks (which is “terminal length 0″ on Cisco devices), the following command can be used:

Export/Import Files

To copy files from or to the Palo Alto firewall, scp or tftp can be used. The commands have both the same structure with “export … to” or “import … from”, e.g.:

User-IDs and Groups

State of the LDAP server connections:

List the groups that are stored in the Palo Alto:

Manual group mapping refresh:

Show the group memberships for a particular user:

IP to User mapping:

User-ID cache clearance:

IP Addresses of FQDN Objects

When using objects with FQDNs, the current IP addresses are not shown in the GUI. The following command displays respectively refreshes them:

IP Addresses of Dynamic Block Lists

Similar, the entries in a dynamic block list can be viewed with:

DNS Proxy

To verify the functionality of DNS proxy objects, at least two commands are useful. Both outputs should speak for themselves:

Active URL Vendor/Database

I had some issues with the two different URL databases “brightcloud” and “PAN-DB”. This is the command to show unambiguously which vendor is active on the PA (independent of the licenses):

The output is either “brightcloud” or “paloaltonetworks”. The standard URL DB up to PAN-OS 5.0 is brightcloud. Beginning with PAN-OS 6.0, the default is PAN-DB (refer to the release notes, section “Changes to Default Behavior”). To change the vendor (of course only if it is licensed), click the “Activate” link under licenses in the GUI.

PAN-DB URL Test & Cache

To show the category of a specific URL, use one of the following commands:

To display the current URL cache from the PAN-DB, two steps are required. The first one is the creation of a logfile which contains all entries and the second one is to display this logfile: