> show interface management
Show management Interface details
> show system info
Display system’s management IP, Serial number, and code version
> show system disk-space
Show percent usage of disk partitions.
> show system software status
Show running processes.
> show system resources
Show processes running in management plane.
> show running resource-monitor
Show resource utilization in the data plane.
> request license info
Show the licenses installed on the device.
> show jobs processed
Show when commits are completed.
> show session info
Display session usage, rate etc. information.
> show session id <session-id>
Display information about a specific session.
> show running security-policy
Show the running security policy.
> request restart system
Restart the device.
> request shutdown system
Shutdown the device.
>request system private-data-reset
Default Factory reset command
> show admins
Show administrators who are currently logged.
> show admins all
Show administrators who can access the web interface or command line interface CLI.
> ping host <destination-ip-address>
Ping from management interface
> ping source <ip-address-on-dataplane> host <destination-ip-address>
Ping from a dataplane interface to a destination IP address
> show running nat-policy
Shows current NAT policy table.
> show running ippool
Shows NAT pool utilization.
> show running global-ippool
Shows NAT pool utilization.
> show routing route
Shows routing table.
> show running security-policy
Shows current policy set.
> show vpn flow
Shows encap/decap counters
> show vpn gateway
Shows list of IKE gateway configurations.
> show vpn ike-sa
Shows IKE Phase 1 SA
> show vpn ipsec-sa
Shows IPSEC Phase 2 SA.
> show vpn tunnel
List of auto-key IPsec tunnel configurations.
> show high-availability state
Shows the HA state of the device.
> show high-availability all
Shows settings configured on device & peer.
> show high-availability state-synchronization
Shows if the devices are synchronized.
> request high-availability state suspend
Suspends active device and makes passive device active.
> request high-availability state functional
Changes the state from suspend to passive.
> request license info
Shows the license installed on the device.
!
Commands
Description
# set zone Outside
Create zone with name Outside.
# set network virtual-router VR-1
Create Virtual Router named VR-1
# set network interface ethernet ethernet1/1 layer3 ip 192.168.100.100/24
Assign IP address and subnet mask to interface ethernet 1/1 and set as Layer 3
# set deviceconfig system type static
Set the interface type to static
# set deviceconfig system type dhcp-client
Set the interface type to DHCP
# set deviceconfig system dns-setting servers
Set Primary and Secondary DNS
# set mgt-config users admin password
Set Administrator password
# set deviceconfig system ip-address
Assign IP address to Management interface.
> find command
Display entire command in current mode.
> find command keyword show
Locate all commands have specified keyword.
1. Palo Alto Hardware Tshoot
Case 01: Chassis related tshoot
show system state filter chassis.leds (For Leds status)
show system environmentals (FAN, Temperature, Power supply )
show system disk-space
show system statistics session
show system software status (Daemons details)
show system services
Case 02: Interface Flapping
show interface ethernet1/21 (Detailed Info)
show interface ethernet1/21 | match link (Link Status)
show interface ethernet1/21 | match address (Mac address)
show interface ae1.60
show interface ae1.60 | match IP
GUI -> Monitor -> System -> See details by setting up the filter ( eventid eq link-change ) and ( object eq 'ethernet1/21' )
Or
show log system query equal "( eventid eq link-change ) and ( object eq 'ethernet1/21' )"
show log system query equal "( eventid eq link-change ) and ( object eq 'ethernet1/21' )" direction equal backward
show log system (display all system log)
show log traffic app ssl (Display traffic log for ssl traffic)
show log traffic query equal "( addr.src in 11.50.151.228 ) and ( addr.dst in 17.188.145.51 )"
show log traffic from equal 11.50.136.218 to equal 199.19.250.205 dport equal 80
Show log traffic src in 11.50.136.218 DST in 199.19.250.205 dport equal 80
2. L2 Tshoot
Layer 2 MAC leaning, VLAN missmatched, Layer 2 loop, Aggregated interface and LACP
show mac all (Shows the mac details for vlan, interfaces)
Case 01: VLAN missmatched
show arp ae1.60 for arp table
show arp management
show arp ethernet1/1
show mac all for mac table
show interface ae1.60 | match received (interface counter)
Show interface ae1.60 | match error (error counter increased due to incorrect tcp/udp checksum, cpd, unexpeted vlan traffic on trunk interface)
Case 02: Aggregate interface issue
show lacp aggregate-ethernet ae1 (check the details )
********************************* How to tshoot silent packet drop on Palo Alto *********************************************
Source IP = 172.16.3.100 , Dest IP = 42.42.100.3
1. Check the session on session table
show session all filter filter source 172.16.3.100 destination 42.42.100.3
2. Enable the debugging on data plane for this traffic
debug dataplane packet-diag set filter match source 172.16.3.100 destination 42.42.100.3 (This is set the debug)
debug dataplane packet-diag set filter on
3. show the debugging log
show counter global filter packet-filter yes delta yes security drop (here we can see the debug counters and session drop reason :: "No destination zone from forwardir)
4. check the routing for the source and destination
test routing fib-lookup ip 42.42.100.3 virtual-router default ( NO route found)
5. Add the route and check the session
set network virtual-router default routing-table ip static-route 42.42.100.3/32 nexthop 192.168.1.1
test routing fib-lookup ip 42.42.100.3 virtual-router default
show session all filter filter source 172.16.3.100 destination 42.42.100.3
!
*******************************************************************************************
Layer 03 Troubel shoot
*******************************************************************************************
IP/Subnet config issue, missing or inactive route, inter virtual router communication error, Dynamic routing protocol issues (OSPF, BGP).
show routing interface (it will show all interfaces which will participate on Routing)
show routing interface | match ae1.960
!
show arp all (This is shows the ARP is resolving or not for an IP/nextHop IP)
show arp all | match 30.191.60.39
!
test routing fib-lookup virtual-router Extranet-VR ip "26.122.64.10" (for getting the next hop)
!
show routing route destination 10.1.1.0/24 (Used to see the all next hops for the 10.1.1.0/24 )
show routing fib virtual-router Extranet-VR | match 10.1.1.0/24 (It will give the active nexthop or preferred next hop).
!
Case 01 :: Static Route issues
!
1. A route can be down 1. Local interface to reach NextHop is down. 2. NextHop can not be resolved locally via ARP.
!
We use the following command to test an active route exit for a destination.
#show routing route destination 10.1.1.0/24
#show arp all
#test routing fib-lookup ip 10.1.1.100 virtual-router Extranet-VR
!
2. If a static route remain inactive make sure to
!
Use correct nexthop type (IP address)
Use the correct Virtual router (If dealing with multiple VR)
Use the correct routing table (Unicast/Multicast)
!
3. Also check the routing table exceed limits
#show routing fib virtual-router default afi ipv4
#show routing resource
!
show interface all (Use to see the IP address/Zone of an interface)
ping count 3 source 165.197.216.4 host 165.197.216.1
traceroute source 165.197.216.4 host 165.197.216.1
!
Case 02 :: Missing Route
!
ping count 3 source 10.1.1.250 host 10.1.1.221 (Not pinging)
show routing route destination 10.1.1.0/24 (look for next hop)
show arp all (For next hop) (No arp for next hop) Fix the route for the route
ping count 3 source 10.1.1.250 host 10.1.1.221
debug dataplane packet-diag set filter on
debug dataplane packet-diag set filter match source 192.168.140.60 destination 192.168.122.60
