Commands to run before and after a PAN-OS upgrade. Enable session logging in SecureCRT (or your terminal) before starting so you have a full record to diff.
Pre-upgrade — Run every command below and save the output as your baseline
Post-upgrade — Run the same commands again and compare against the baseline
Diff the two captures to spot regressions (route count changes, flapping peers, dropped LACP members, etc.)
Tip: Disable the pager at the start so output flows continuously into your log file.
Output size: Some commands produce very long output (full routing/BGP tables, ARP caches). These are marked with a ⚠ below. They’re still worth capturing for a proper diff, but be aware of the volume — especially on boxes with large route tables or many connected hosts.
System
Command
Why
set cli pager off
Disable pagination so output streams cleanly into your session log
show system info
Baseline PAN-OS version, serial number, uptime, hostname, and management IP
show system resources
Verify CPU / memory utilisation isn’t pegged after the new image loads
show system disk-space
Confirm no partition is full — upgrades can fail or logs can stop if disk is exhausted
show system environmentals
Fan speeds, temperatures, power supply status — rule out hardware stress
show chassis status
Chassis / slot health (especially relevant on PA-5400, PA-7000 series)
show clock
Confirm time is correct — log correlation depends on it
debug management-server show ntp
Verify NTP is synced; clock drift post-reboot breaks syslog and SIEM correlation
show jobs all
Check for any pending or failed jobs (commits, content installs)
show system software status
Confirm which software slots are installed and which is active
Licensing
Command
Why
request license info
Ensure licensed features (Threat Prevention, GlobalProtect, WildFire, URL Filtering, DNS Security) didn’t deactivate after upgrade
High Availability
Command
Why
show high-availability all
All-in-one view: local/peer state, sync status, link and path monitoring
show high-availability transitions
Check if failover was clean or if the pair was flapping
show high-availability state-synchronization
Confirm running config is in sync between peers
Interfaces
Command
Why
show interface hardware
Physical link status, speed/duplex, and error counters. ⚠ Lengthy on chassis models with 40+ ports
show interface all
Logical interface states (up/down) across all interfaces
show lacp aggregate-ethernet all
Confirm all AE (port-channel) members rejoined the bundle post-reboot
show lldp local all
Verify the firewall is advertising itself correctly to the network
show lldp neighbors all
Confirm what’s on the other end of each cable and on which ports
show counter global filter severity drop
Check for unexpected packet drops — compare pre vs post counts. ⚠ Many counter categories
Routing
Command
Why
show routing summary
Quick count of routes by protocol (OSPF/BGP/Static) — best for at-a-glance parity. Lightweight — run this first
show routing route
⚠ Full RIB — what’s programmed in the control plane. Can be thousands of lines
show routing fib
⚠ Full FIB — what’s actually programmed in the data plane. Often even longer than the RIB
Lighter alternative: If you only need to confirm parity, show routing summary may be enough. Run the full RIB/FIB dumps only when you need a line-by-line diff or suspect missing routes.
BGP
Command
Why
show routing protocol bgp summary
Peer states and prefix counts — all peers should show Established
show routing protocol bgp loc-rib
⚠ Verify the actual BGP table content and path selection. Large with many prefixes
show routing protocol bgp peer
All peer detail — confirms Graceful Restart capability, hold timers, and per-peer state
show routing protocol bgp rib-out
⚠ What you’re advertising to peers — compare pre/post to catch withdrawn routes
Lighter alternative:bgp summary gives you peer state + prefix counts in a few lines. Only pull the full loc-rib / rib-out when you need to verify specific prefixes or investigate the PAN-304636 bug.
| show routing protocol bgp policy aggregate | Check for aggregate routes |
| show routing route \| match discard | Look for discard/null routes in the routing table |
PAN-304636 check: After running show routing protocol bgp loc-rib, look for the A (Aggregate) flag next to routes. If the bug applies, you’d see aggregate/null routes leaking into the BGP table. Cross-reference with the aggregate and discard commands above.
OSPF
Command
Why
show routing protocol ospf neighbor
All adjacencies should be in Full state
show routing protocol ospf graceful-restart
Confirm the GR helper-mode cycle completed cleanly
show routing protocol ospf summary
OSPF area and LSA counts for parity check
BFD
Command
Why
show routing bfd summary
All sessions should be Up with stable timers — flapping here means routing will flap
Network
Command
Why
show arp all
⚠ Verify IP-to-MAC mappings are correct, especially for the HA VMAC. Can be thousands of entries on busy segments
show mac all
MAC address table — useful on L2 subinterfaces or vwire deployments
Sessions & Traffic
Command
Why
show session info
Session settings, CPS, and current session count
show system statistics session
Session utilisation summary — active count vs max, throughput
show running resource-monitor
Dataplane CPU, session rate, and packet buffer utilisation
Content & Signatures
Command
Why
show system setting content-id
Currently installed App-ID, Threat, Antivirus, and WildFire versions
show wildfire status
WildFire cloud connectivity and forwarding status
GlobalProtect
Command
Why
show global-protect-gateway status
Gateway enabled and accepting connections
show global-protect-gateway statistics
Current / previous user counts — compare pre vs post