The following table provides quick start information for configuring the features of Palo Alto Networks devices from the CLI. Where applicable for firewalls with multiple virtual systems (vsys), the table also shows the location to configure shared settings and vsys-specific settings.

TO CONFIGURE…	START HERE…
MGT interface	# set deviceconfig system ip-address
admin password	# set mgt-config users admin password
DNS	# set deviceconfig system dns-setting servers
NTP	# set deviceconfig system ntp-servers
Interfaces	# set network interface
System settings	# set deviceconfig system
Zones	# set zone <name> # set vsys <name> zone <name>
Security Profiles HIP Objects/Profiles URL Filtering Profiles WildFire Analysis Profiles	# set profiles # set vsys <name> profiles # set shared profiles
Server Profiles	# set server-profile # set vsys <name> server-profile # set shared server-profile
Authentication Profiles	# set authentication-profile # set vsys <name> authentication-profile # set shared authentication-profile
Certificate Profiles	# set certificate-profile # set vsys <name> certificate-profile # set shared certificate-profile
Policy	# set rulebase # set vsys vsys1 rulebase
Log Quotas	# set deviceconfig setting management quota-settings
User-ID	# set user-id-agent # set vsys <name> user-id-agent # set user-id-collector # set vsys <name> user-id-collector
HA	# set deviceconfig high-availability
AutoFocus Settings	# set deviceconfig setting autofocus
WildFire Settings	# set deviceconfig setting wildfire
Panorama	# set deviceconfig system panorama-server
Restart	> request restart system

Palo Alto firewall – CLI Commands Cheat Sheet

Here are PAN-OS CLI commands.

▶ Device Management

CLI Cheat Sheet: Device Management

show system info
show system disk-space
show system logdb-quota
show system software status
show system resources
show running resource-monitor
request license info
show jobs processed
show session info
show session all
show session all filter
show session meter
show session id session-id
show running security-policy
less mp-log authd.log
request restart system
show admins
show admins all
set deviceconfig system type dhcp-client accept-dhcp-domain accept-dhcp-hostname send-client-id send-hostname

▶ User-ID

CLI Cheat Sheet: User-ID

debug user-id log-ip-user-mapping yes
debug user-id log-ip-user-mapping no
show user user-id-agent state all
show user server-monitor state all
show user server-monitor statistics
show user user-id-agent config name
show user group-mapping statistics
show user group-mapping state all
show user group list
show user group name
show user ip-user-mapping all
show user ip-user-mapping all | match \\
show user ip-user-mapping ip
show user user-ids
show log userid datasourcename equal direction equal backward
show log userid datasourcetype equal
show log userid datasourcetype equal kerberos
show log userid datasource equal
show log userid datasourcetype equal xml-api
show user email-lookup
show user email-lookup base “DC=lab,DC=sg,DC=acme,DC=local” bind-dn “CN=Administrator,CN=Users,DC=lab,DC=sg,DC=acme,DC=local” bind-password acme use-ssl no email user1@lab.sg.acme.local mail-attribute mail server 10.1.1.1 server-port 389 labsg\user1
clear user-cache all
clear user-cache ip

▶ HA

CLI Cheat Sheet: HA

show high-availability cluster all
show high-availability cluster flap-statistics
show high-availability cluster ha4-status
show high-availability cluster ha4-backup-status
show high-availability cluster session-synchronization
show high-availability cluster state
show high-availability cluster statistics
clear high-availability cluster statistics
request high-availability cluster clear-cache
request high-availability cluster sync-from
show high-availability interface ha2 | match bytes
request high-availability state suspend

▶ Networking

CLI Cheat Sheet: Networking

show routing route
show routing fib virtual-router name | match x.x.x.x
set system setting arp-cache-timeout <60-65536>
show system setting arp-cache-timeout

show running nat-policy
test nat-policy-match
show running ippool
show running global-ippool

show vpn flow
show vpn gateway
show vpn ike-sa
show vpn ipsec-sa
show vpn tunnel
test vpn ike-sa gateway
test vpn ipsec-sa tunnel

show routing bfd active-profile []
show routing bfd details [interface ] [local-ip ] [multihop][peer-ip ] [session-id] [virtual-router ]
show routing bfd drop-counters session-id
show counter global | match bfd
clear routing bfd counters session-id all | <1-1024>
clear routing bfd session-state session-id all | <1-1024>

set session pvst-native-vlan-id
set session drop-stp-packet
show vlan all
show counter global

ping host destination-ip-address
ping source ip-address-on-dataplane host destination-ip-address
traceroute host remote host
show netstat statistics yes

▶ VSYS

CLI Cheat Sheet: VSYS

show system info | match vsys
set system setting target-vsys ?
set system setting target-vsys vsys-name
set system setting target-vsys vsys2
show session meter
show user ip-user-mapping all
set system setting target-vsys none

▶ Panorama

CLI Cheat Sheet: Panorama

show system info | match system-mode
request system system-mode logger
request system system-mode panurldb
request system system-mode panorama
request system system-mode legacy

set cli config-output-mode set
show device-group branch-offices
set panorama [off | on]
request high-availability sync-to-remote [running-config | candidate-config]
request batch reboot [devices | log-collectors]
set dlsrvr poll-interval <5-60>

show devicegroups name
show templates name
show config pushed-shared-policy
show config pushed-template

PAN-OS 10.0 Configure CLI Command Hierarchy

https://docs.paloaltonetworks.com/pan-os/10-0/cli-reference/pan-os-10-0-configure-cli-command-hierarchy.html

Palo Alto Basics

CLI Jump Start