GlobalProtect CLI Command Reference
paloalto globalprotect cli command
Quick Reference Commands
show global-protect-gateway current-user
show global-protect-gateway statistics
Gateway Commands
| What you’re validating | CLI command | What to look for |
|---|---|---|
| Who’s connected right now | show global-protect-gateway current-user | User list + tunnel name; confirms the gateway is actively terminating sessions |
| Quickly list just usernames | show global-protect-gateway current-user | match "User Name" | Fast sanity check when there are lots of users |
| Was it accepting users before/after reboot | show global-protect-gateway previous-user | Recent history; useful post-upgrade to confirm reconnections happened |
| Counts / health at a glance | show global-protect-gateway statistics | Current/previous totals and general stats (good for “did we drop to zero?“) |
| Specific user lookup | show global-protect-gateway current-user user username | Details for specific user |
Portal Commands
| Command | Description |
|---|---|
show global-protect-portal current-user | Users authenticated to portal |
show global-protect-portal statistics | Portal authentication stats |
Troubleshooting Commands
Debug Logging
# Enable GP debug (temporary, reverts on restart)
debug global-protect debug on
# View debug logs
less mp-log gp-debug.log
# Disable when done
debug global-protect debug off
Connection Issues
| Command | Use Case |
|---|---|
show global-protect-gateway current-user | match "Virtual IP" | Check IP assignment |
show global-protect-gateway current-user | match "Public IP" | See client’s public IP |
show global-protect-gateway current-user | match "Login Time" | When user connected |
show global-protect-gateway current-user | match "Inner IP" | Client’s LAN IP |
Check Gateway Status
# Gateway summary
show global-protect-gateway status
# Check if gateway is enabled
show global-protect-gateway config
Session Details
# All session info for current users
show global-protect-gateway current-user detail
# Specific user session
show global-protect-gateway current-user user jsmith detail
Authentication Issues
# Check authentication server profiles
show authentication auth-method-status
# Check LDAP connectivity
test authentication authentication-profile LDAP-Profile username jsmith password
SSL/IPSec Tunnel Stats
# IPSec tunnel status
show vpn ipsec-sa
# SSL-VPN info
show vpn tunnel
Output Filtering
Combine with | match for specific info:
# Find specific user
show global-protect-gateway current-user | match "jsmith"
# Count connected users (count lines with User Name)
show global-protect-gateway current-user | match "User Name" | count
# Show users from specific public IP
show global-protect-gateway current-user | match "73.158.255.70"
Common Troubleshooting Workflows
User Can’t Connect
-
Check if gateway is up
show global-protect-gateway status -
Verify authentication
test authentication authentication-profile GP-Auth username jsmith password -
Check certificate
show sslmgr-store certificate name GP-CERT -
Review logs
show log system subtype eq globalprotect direction equal backward
User Connected But No Traffic
-
Verify tunnel is established
show global-protect-gateway current-user user jsmith detail -
Check assigned IP
show global-protect-gateway current-user | match "Virtual IP" -
Verify routing
show routing route destination 10.x.x.x # internal network -
Check security policy
test security-policy-match from GP-Zone to Trust source 10.x.x.x destination 10.y.y.y application any protocol 6 destination-port 443
Post-Upgrade Validation
-
Check current connections
show global-protect-gateway statistics show global-protect-gateway current-user | match "User Name" | count -
Compare with previous
show global-protect-gateway previous-user | match "User Name" | count -
Verify gateway is accepting connections
show global-protect-gateway status