Essential PAN-OS Commands | Palo Alto CLI Guide

PAN-OS: Essential Configuration Commands

April 15, 2026·2 min read·366 words

PAN-OS is the operating system used by Palo Alto firewalls. It is accessible through the web GUI (primary interface) and the CLI (advanced troubleshooting). This guide covers the essential commands for configuration, troubleshooting, packet capture, and upgrades.

CLI Modes

SSH access is available by default through ethernet1/1 or the management interface (192.168.1.1)
Operational mode (>): show, ping, test
Configuration mode: configure (followed by the hash prompt #)
Commit-based workflow: changes are made to the candidate configuration and applied with commit

Operational Commands

show system info: PAN-OS version and uptime
show interface all: interface status
show routing table: virtual routing table
show running security-policy: active policies
show session all filter source 10.0.0.5: active traffic filtered by source
show counter global: global counters (drops and allows)
show log traffic last 50 direction equal backward: last 50 sessions

Basic Configuration

configure
set deviceconfig system hostname PA-PARIS-01
set deviceconfig system ntp-servers primary-ntp-server ntp-server-address 192.0.2.1
set network interface ethernet ethernet1/1 layer3 ip 203.0.113.2/30
set zone UNTRUST network layer3 ethernet1/1
set rulebase security rules Allow-Web from LAN to UNTRUST source any destination any application web-browsing service application-default action allow
commit

Packet Capture Troubleshooting

debug dataplane packet-diag set filter match source 10.0.0.5
debug dataplane packet-diag set filter on
debug dataplane packet-diag set capture stage receive file rx.pcap
debug dataplane packet-diag set capture on
... reproduce the issue ...
debug dataplane packet-diag set capture off
scp export filter-pcap from rx.pcap to user@server:/tmp/: export the capture

Test Commands

test security-policy-match from LAN to UNTRUST source 10.0.0.5 destination 8.8.8.8 protocol 6 destination-port 443: check which rule would match
test vpn ike-sa gateway VPN-Site-A: IPsec phase 1 status
test vpn ipsec-sa tunnel VPN-Site-A-Tunnel: phase 2 status
test panagent status: User-ID agent (AD) status
test dns ip 8.8.8.8: DNS resolution

Upgrade PAN-OS

request system software check: view available versions
request system software download version 11.1.3
request system software install version 11.1.3
request restart system: reboot
show jobs all: monitor the installation in progress

HA

show high-availability state: active or passive status
request high-availability state suspend: force passive state for maintenance
request high-availability state functional: return to active operation

Order from OPTINOC

Preconfigured Palo Alto PA-Series with the Complete Bundle. PAN-OS training for customers. 24×7 support from French-speaking experts.

Frequently Asked Questions

PAN-OS supporte le rollback ?

Oui. La commande revert config restaure la dernière config commitée. Plus puissant : load config from saved-config.xml (depuis snapshot manuel) ou load config last-committed (dernier commit). Toujours faire un commit-and-push descriptif pour traçabilité.

Comment configurer en CLI plutôt qu'en GUI ?

Mode configure (depuis operational), puis set commands hiérarchiques (set network interface ethernet ethernet1/1 ip 10.0.0.1/24). Les configurations passent en candidate config, puis commit pour les appliquer.