Palo Alto Networks Firewall (PAN-OS) Cheatsheet - Complete Reference 2025

This cheatsheet provides a concise, practical reference for Palo Alto Networks Firewall administrators, covering essential PAN-OS concepts, CLI commands, GUI tasks, and troubleshooting tips for real-world enterprise environments. Information is current as of December 2025, primarily referencing PAN-OS 11.1+.

Quick Reference: Most Used Commands

Basic Operations & System Management

CLI Modes

Basic System Commands

Configuration Management

Network Configuration

Zones and Interfaces

Palo Alto Networks firewalls use security zones to group interfaces with similar security requirements. Policies are applied between zones, not directly between interfaces.

Interface Types

CLI Examples for Interface Configuration (Layer 3)

// Enter configuration mode
configure

// Set Ethernet interface 1/1 to Layer3 mode
set network interface ethernet ethernet1/1 layer3

// Assign IP address and management profile
set network interface ethernet ethernet1/1 layer3 ip 192.168.1.1/24
set network interface ethernet ethernet1/1 layer3 management-profile allow-all

// Create a Security Zone
set network zone LAN type layer3
set network zone LAN interface ethernet1/1

// Commit changes
commit

Virtual Routers

Virtual routers manage routing tables and forward traffic between connected interfaces.

Security Policies

Security policies are the core of the firewall’s enforcement, controlling traffic flow based on App-ID, User-ID, Content-ID, zones, and more.

Policy Structure

App-ID Overview

App-ID identifies applications regardless of port, protocol, or evasive tactics. It’s crucial for granular policy enforcement.

Explanation: App-ID uses multiple classification mechanisms (application signatures, decryption, protocol decoding, heuristics) to identify the exact application traversing the firewall. Use Case: Instead of allowing tcp/80 and tcp/443, you can allow web-browsing, facebook-base, sharepoint-online, providing much finer control and visibility.

User-ID Overview

User-ID maps IP addresses to usernames, integrating with directory services (AD, LDAP) to enforce policies based on users/groups.

Explanation: User-ID agents (Windows, Linux, Exchange) or direct firewall integration (Syslog, API, Captive Portal) collect user-to-IP mappings. Use Case: Create policies like “HR Group can access Payroll Application” instead of “IP Range X can access IP Range Y on port Z”.

Content-ID (Security Profiles)

Content-ID refers to the suite of security profiles that inspect allowed traffic for threats, sensitive data, and malicious content.

CLI Example: Basic Security Policy

// Enter configuration mode
configure

// Create an Address Object
set address Internal_Users ip-netmask 192.168.1.0/24

// Create a Security Policy Rule
set rulebase security rules "Allow Web Browsing" from LAN to WAN source Internal_Users destination any application web-browsing service application-default action allow
set rulebase security rules "Allow Web Browsing" profile-setting group "default-profiles" // Assuming a profile group exists

// Commit changes
commit

NAT Rules

Network Address Translation (NAT) rules modify IP addresses and/or ports of packets as they traverse the firewall.

NAT Rule Types

Source NAT Configuration (Dynamic IP and Port)

// Enter configuration mode
configure

// Create a NAT policy rule
set rulebase nat rules "Outbound SNAT" from LAN to WAN source any destination any service any
set rulebase nat rules "Outbound SNAT" translate-packet source dynamic-ip-and-port interface ethernet1/2 // Assuming ethernet1/2 is the WAN interface
set rulebase nat rules "Outbound SNAT" to-interface ethernet1/2

// Commit changes
commit

Destination NAT Configuration (Port Forwarding)

// Enter configuration mode
configure

// Create an Address Object for the public IP
set address Public_Web_IP ip-netmask 203.0.113.10/32

// Create an Address Object for the internal server
set address Internal_Web_Server ip-netmask 10.0.0.50/32

// Create a NAT policy rule
set rulebase nat rules "Inbound DNAT Web" from WAN to LAN source any destination Public_Web_IP service tcp/80
set rulebase nat rules "Inbound DNAT Web" translate-packet destination static-ip Internal_Web_Server
set rulebase nat rules "Inbound DNAT Web" to-interface ethernet1/1 // Assuming ethernet1/1 is the LAN interface

// Commit changes
commit

SSL Decryption Basics

SSL/TLS decryption allows the firewall to inspect encrypted traffic for threats, sensitive data, and policy violations.

Decryption Types

Decryption Policy

Decryption policies determine which traffic to decrypt and which to exclude.

CLI Example: Basic Forward Proxy Decryption

// Enter configuration mode
configure

// Generate a new self-signed root CA for decryption (or import existing)
set deviceconfig certificate generate-certificate name "Decryption-CA" common-name "PaloAlto-Decryption-CA" certificate-authority yes algorithm rsa bits 2048 expire-on 2035-12-30

// Set the generated CA as the Forward Trust and Untrust CA
set deviceconfig setting ssl-decrypt forward-proxy-cert "Decryption-CA"
set deviceconfig setting ssl-decrypt forward-untrust-cert "Decryption-CA"

// Create a Decryption Policy to decrypt all outbound HTTPS traffic
set rulebase decryption rules "Decrypt Outbound HTTPS" from LAN to WAN source any destination any service service-https action decrypt

// Commit changes
commit

Note: The generated certificate needs to be exported and imported into client trust stores for seamless decryption.

VPN

IPSec VPN (Site-to-Site)

Connects two networks securely over an untrusted network (e.g., internet).

CLI Example: Verifying IPSec Tunnel Status

show vpn ike-sa
show vpn ipsec-sa

GlobalProtect (Remote Access VPN)

Provides secure remote access for mobile users to corporate resources.

CLI Example: Verifying GlobalProtect Status

show global-protect gateway current-user
show global-protect portal current-user

Logging & Monitoring

Log Types

Monitoring Tools

• Monitor Tab (GUI): Centralized view for logs, reports, ACC (Application Command Center).
• ACC (Application Command Center): Interactive dashboard for network visibility and threat analysis.
• CLI: show commands for real-time status and logs.
• External Log Collectors: Panorama, Syslog servers, SIEMs.

CLI Example: Viewing Logs

// Show traffic logs
show log traffic

// Show threat logs filtered by severity
show log threat severity critical

// Show system logs
show log system

// Show logs for a specific source IP
show log traffic source 192.168.1.10

Advanced CLI & Troubleshooting

Packet Flow & Debugging

Understanding the packet flow is crucial for troubleshooting.

// Syntax for packet flow debug (use with caution in production)
debug flow set log-packet on
debug flow basic
debug flow filter match source <src-ip> destination <dst-ip> protocol <proto> destination-port <port>
debug flow on
// ... generate traffic ...
debug flow off
less mp-log pan_packet_diag.log

Explanation: This sequence enables packet debugging, sets a filter, turns on debugging, waits for traffic, turns off debugging, and then displays the log. Use Case: Pinpointing exactly where a packet is dropped or misrouted within the firewall’s processing stages.

Session Management

Policy Troubleshooting

Interface Troubleshooting

Common Patterns

Basic Internet Access Policy

// Goal: Allow internal users to browse the internet securely.

1.  **NAT Rule:** Source NAT (Dynamic IP and Port) from LAN to WAN, using the WAN interface IP.
    - `from: LAN`, `to: WAN`, `source: any`, `destination: any`, `service: any`
    - `translate-packet: source dynamic-ip-and-port interface ethernet1/2` (WAN interface)

2.  **Security Policy:** Allow web browsing and other internet applications.
    - `name: Allow-Internal-Internet`
    - `from: LAN`, `to: WAN`
    - `source: Internal-Users` (Address object for internal subnets/users)
    - `destination: any`
    - `application: web-browsing, ssl, dns, office365-base, google-base` (be specific, avoid `any`)
    - `service: application-default`
    - `action: allow`
    - `profile-setting: default-profiles` (or custom security profile group)
    - `log-forwarding: default` (ensure logging is enabled)

3.  **Decryption Policy (Optional but Recommended):** Decrypt outbound SSL/TLS traffic.
    - `name: Decrypt-Outbound`
    - `from: LAN`, `to: WAN`
    - `source: Internal-Users`
    - `destination: any`
    - `service: service-https`
    - `action: decrypt`

DMZ Access Policy

// Goal: Allow limited, secure access to a DMZ web server from the internet.

1.  **Address Objects:**
    - `Public_Web_IP` (e.g., 203.0.113.10/32)
    - `Internal_Web_Server` (e.g., 10.0.0.50/32)

2.  **NAT Rule:** Destination NAT for inbound web traffic.
    - `from: WAN`, `to: DMZ`
    - `source: any`, `destination: Public_Web_IP`, `service: tcp/80, tcp/443`
    - `translate-packet: destination static-ip Internal_Web_Server`
    - `to-interface: ethernet1/3` (DMZ interface)

3.  **Security Policy:** Allow specific web applications to the DMZ server.
    - `name: Allow-Internet-to-DMZ-Web`
    - `from: WAN`, `to: DMZ`
    - `source: any`
    - `destination: Internal_Web_Server`
    - `application: web-browsing, ssl`
    - `service: application-default`
    - `action: allow`
    - `profile-setting: default-profiles` (or custom security profile group)
    - `log-forwarding: default`

Tips & Tricks

Pro Tips

• Always use App-ID: Avoid any for applications. Use application-default for services.
• Leverage User-ID: Implement User-ID for granular, user-based policies.
• Security Profiles on all allow rules: Don’t just permit traffic; inspect it.
• Policy Ordering: Place more specific rules higher. Deny rules should be above broad allow rules.
• Commit Comments: Always add descriptive comments to your commits.
• Test before Deploy: Use test security-policy-match and validate before commit.
• Regularly Review Logs: Monitor logs (Traffic, Threat, URL) to understand network behavior and identify anomalies.
• Use Address/Service/Application Groups: Simplify policy management.
• Profile Groups: Apply consistent security profiles across multiple rules.

Common Gotchas & Misconfigurations

• any in policies: Overly permissive rules (any for source, destination, application, service) are a major security risk.
• NAT before Security Policy: Remember NAT occurs before policy lookup for inbound traffic, and after for outbound.
• Missing Security Profiles: Allowing traffic without inspecting it (no AV, URL, VP) defeats the purpose of a Next-Gen Firewall.
• Incorrect Zone Assignment: Interfaces must be in the correct security zones for policies to apply.
• Asymmetric Routing: Traffic exiting via a different path than it entered can cause session drops.
• Decryption Issues: Incorrect CA deployment on clients or missing server certificates for inbound decryption.
• Commit Failures: Often due to syntax errors or conflicting configurations; read the error messages carefully.
• DNS Resolution: Ensure the firewall can resolve DNS for App-ID updates, URL filtering, and management.

Quick Troubleshooting Checks

1. Connectivity (Ping/Traceroute):
   • ping host <ip>
   • traceroute host <ip>
   • ping source <interface> host <ip>
2. Interface Status:
   • show interface ethernet <id> (Check link/speed, errors)
3. Routing:
   • show routing route (Is there a route to the destination?)
4. Security Policy Match:
   • test security-policy-match source <src-ip> destination <dst-ip> destination-port <port> application <app> (Is the correct rule being hit? Is the action allow?)
5. Session Lookup:
   • show session all filter source <src-ip> destination <dst-ip> (Is a session being established? What’s the state?)
6. Logs:
   • Check Traffic logs for deny actions, Threat logs for blocks, URL logs for filtering.
   • show log traffic filter source <src-ip> destination <dst-ip>
7. NAT Rules:
   • show running rulebase nat (Is the NAT rule configured correctly and matching?)
8. App-ID/User-ID:
   • show session all filter source <src-ip> (Check identified application and user)
   • show user ip-user-mapping all (Verify User-ID mappings)
9. Resource Utilization:
   • show running resource-monitor (CPU, memory, session count)

Version Information

This cheatsheet is based on features and commands available in PAN-OS Version 11.1+ as of December 2025. While many commands and concepts are consistent across PAN-OS versions, specific features, CLI syntax, and best practices may evolve with newer releases. Always refer to the official Palo Alto Networks documentation for the most accurate and up-to-date information for your specific PAN-OS version.

References

1. Palo Alto Networks Documentation Portal
2. PAN-OS CLI Quick Start
3. Security Policy Best Practices
4. App-ID Overview
5. Decryption Basics

Transparency Note

This cheatsheet was generated by an AI expert based on publicly available documentation and common industry practices for Palo Alto Networks Firewalls. While efforts have been made to ensure accuracy and currency as of December 2025, network security configurations are highly specific to individual environments. Always validate commands and configurations against your specific PAN-OS version and network requirements, and consult official vendor documentation for critical deployments.