Tuesday, June 20, 2023

Paloalto Networks CLI Cheat Sheet

https://www.paloaltonetworks.com/content/dam/pan/en_US/images/logos/brand/primary-company-logo/Parent-logo.png?imbypass=on&imwidth=1920 

 

Function / Usage : CLI Command :
Enter configuration mode  > configure
Show system disk usage > show system disk-space
Show all licenses  > request license info
Show the running route table  > show routing route
Show the forwarding table  > show routing fib
Test routing for a destination  > test routing fib-lookup ip <destination> virtual-router <virtual router>
Show all interfaces  > show interface all
Show interface details and counters  > show interface <name>
Show SDWAN session distribution > show sdwan session distribution policy-name <policy-name>
Show SDWAN connection > show sdwan connection all
Show all ARP entries  > show arp all
Show ARP entries for a particular interface  > show arp <interface>
Show Blocked Ips > show dos-protection zone <zone-name> blocked source
Clear Blocked IP > clear dos-protection zone <zone-name> blocked source <blocked-ip>
Clear all Blocked Ips > clear dos-protection zone <zone-name> blocked all
Clear traffics log > clear log traffic
Clear systems log > clear log system
Show global system counters  > show counter global
Show global counters that have changed since last run  > show counter global filter delta yes
Show global counters that match the current packet capture filters  > show counter global filter packet-filter yes
Restart the device  > request restart system
Ping a destination  > ping host <destination>
Ping a destination from a particular interface IP  > ping source <interface ip> host <destination> 
Show device information  > show system info
Show all jobs  > show jobs all
Show a particular job  > show jobs id <id>
Check PANOS software update > request system software check preferred base
Set the management interface to use a static IP  # set deviceconfig system type static
  # set deviceconfig system ip-address <ip-address> netmask <netmask> default-gateway <default-gateway>
Commit changes  # commit
Save configuration to file # save config to <file-name>
Test an IKE gateway (phase 1)  > test vpn ike-sa gateway <name>
Test an IPSec tunnel (phase 1 & 2)  > test vpn ipsec-sa tunnel <name>
Show active session information  > show system statistics session
Show per-application session stats  > show system statistics application
Test a URL's categorization  > test url <URL>
Show all attributes for users with group mapping  > show user user-attributes user all 

Paloalto 100% full /opt/pancfg

﷽ On Palo Alto Networks firewalls, a 100% full /opt/pancfg partition is a known critical issue and can break commits, upgrades, and logging....