Palo Alto CLI Cheat Sheet
paloalto cli command
Common operational commands for day-to-day checks and troubleshooting.
For topic-specific commands see: PAN CLI - GP Commands, PAN CLI - Validate Interfaces, PAN CLI - Pager (Output Control)
System Info & Health
| Command | Description |
|---|
show system info | PAN-OS version, uptime, serial, model, hostname |
show system resources | CPU / memory utilisation (top-style) |
show system disk-space | Disk usage per partition |
show system software status | Running software packages |
show system environmentals | Fan, thermal, power sensor readings |
show jobs all | Commit / download / install job history |
show clock | Current device time and timezone |
debug management-server show ntp | NTP sync status |
Sessions
| Command | Description |
|---|
show system statistics session | Session utilisation summary (active, max, throughput) |
show session all | List all active sessions |
show session all filter source 10.1.1.1 | Sessions from a specific source IP |
show session all filter destination 10.1.1.1 | Sessions to a specific destination IP |
show session all filter application web-browsing | Sessions for a specific App-ID |
show session all filter destination-port 443 | Sessions by destination port |
show session id <id> | Full detail for a single session |
show session info | Session settings (timeout defaults, TCP parameters) |
show running resource-monitor | Dataplane resource / session-rate stats |
High Availability
| Command | Description |
|---|
show high-availability all | Full HA state (local + peer) |
show high-availability state | Quick local/peer active-passive status |
show high-availability link-monitoring | HA link monitoring group status |
show high-availability path-monitoring | HA path monitoring status |
show high-availability state-synchronization | Config sync status between peers |
request high-availability sync-to-remote running-config | Push running config to peer |
Logs (CLI)
| Command | Description |
|---|
show log traffic direction equal backward | Recent traffic log entries |
show log system direction equal backward | Recent system events |
show log config direction equal backward | Recent config changes |
show log threat direction equal backward | Recent threat log entries |
show log url direction equal backward | Recent URL filtering entries |
show log alarm | Active alarms |
less mp-log ms.log | Management-plane service log |
Append | match "<pattern>" to filter any log output.
Security Policy & Testing
| Command | Description |
|---|
show running security-policy | Active security rules (post-commit) |
test security-policy-match from Trust to Untrust source 10.1.1.1 destination 8.8.8.8 application dns protocol 17 destination-port 53 | Simulate policy lookup |
show rule-hit-count vsys vsys1 security | Hit counts per rule (find unused rules) |
NAT
| Command | Description |
|---|
show running nat-policy | Active NAT rules |
test nat-policy-match from Trust to Untrust source 10.1.1.1 destination 8.8.8.8 protocol 6 destination-port 443 | Simulate NAT lookup |
show session all filter nat equal yes | All NATed sessions |
Routing (Quick Checks)
| Command | Description |
|---|
show routing route | Full routing table |
show routing route destination 10.1.1.0/24 | Lookup a specific route |
show routing summary | Protocol / route-count summary |
show routing protocol bgp summary | BGP peer states |
show routing protocol ospf neighbor | OSPF adjacencies |
For protocol details see: OSPF - Reference, BGP - Reference, PAN - BGP Configuration
Interfaces (Quick Checks)
| Command | Description |
|---|
show interface all | Status of all interfaces |
show interface ethernet1/1 | Single interface detail |
show interface management | Management interface info |
show counter global | Global packet counters (drops, errors) |
show counter global filter severity drop | Only drop counters |
Licenses & Content Updates
| Command | Description |
|---|
request license info | Installed licenses and expiry dates |
show system setting ssl-decrypt certificate | SSL decrypt CA cert info |
request content upgrade check | Check for new content (App-ID / Threat) |
show content app-version all | Installed App-ID versions |
request anti-virus upgrade check | Check for new AV signatures |
Config Management
| Command | Description |
|---|
show config running | Full running configuration |
show config candidate | Uncommitted candidate config |
show config diff | Diff between candidate and running |
configure | Enter configuration mode |
commit | Commit candidate config |
commit force | Commit even with warnings |
load config last-saved | Revert candidate to last saved |
save config to <filename> | Export named config snapshot |
scp export configuration from running-config.xml to user@host:path | SCP config off-box |
Packet Capture
# Stage 1 - define filters
debug dataplane packet-diag set filter match source 10.1.1.1 destination 10.2.2.2
# Stage 2 - set capture stages
debug dataplane packet-diag set capture stage receive file rx.pcap
debug dataplane packet-diag set capture stage transmit file tx.pcap
debug dataplane packet-diag set capture stage drop file drop.pcap
debug dataplane packet-diag set capture stage firewall file fw.pcap
# Stage 3 - enable
debug dataplane packet-diag set filter on
debug dataplane packet-diag set capture on
# Stage 4 - stop and collect
debug dataplane packet-diag set capture off
debug dataplane packet-diag set filter off
debug dataplane packet-diag aggregate-logs
# Stage 5 - export
scp export filter-pcap from rx.pcap to user@host:path
Management Access
| Command | Description |
|---|
show admins | Currently logged-in admin sessions |
show admins all | All admin accounts |
set cli timeout <minutes> | Set idle timeout for current session |
debug management-server show | MGT-plane service status |
Useful Shortcuts
find command keyword <word> - Search CLI tree for commands containing a keywordrequest restart system - Reboot the firewallrequest shutdown system - Graceful shutdownset cli pager off - Disable pagination (see PAN CLI - Pager (Output Control))less dp-log pan_task - Dataplane task log (crash / restart info)