Palo Alto CLI Commands for Troubleshooting: The Complete List

When traffic stops flowing through a Palo Alto firewall, the PAN-OS CLI is where you find the answer — sessions, routing, policy matching and logs can all be inspected without touching the GUI. This field-ready reference compiles the operational and troubleshooting commands every engineer should know, organized by function: system information, session inspection, routing and interface validation, policy testing, logging, and health checks — plus a practical six-step troubleshooting workflow to follow when something breaks.

System Information

show system info
show system environmentals
show system software-status
show system logdb-quota

Session Inspection

Confirm traffic is actually hitting the firewall and being processed:

show session all
show session info

To force traffic re-evaluation after policy or NAT changes:

clear session all

Warning: clear session all immediately terminates every active connection. Clear only the specific session ID whenever possible, and avoid it during peak hours.

Routing and Network Validation

show routing route          # how the firewall forwards traffic
show interface all           # link status, speed, errors
show interface ethernet1/1   # isolate a specific interface

Policy Validation

show running security-policy
test security-policy-match source <ip> destination <ip> application <app>

Test which rule will match specific traffic before deep-diving into packet captures.

Logging and Visibility

show log traffic
show log system

show log traffic confirms whether traffic is allowed, denied or dropped; show log system surfaces commits and system-level events.

Operational Health Checks

show system resources
show high-availability state

Practical Troubleshooting Workflow

1. Confirm routing — show routing route
2. Verify interface status — show interface all
3. Test policy match — test security-policy-match
4. Inspect active sessions — show session all
5. Review traffic logs — show log traffic
6. Clear sessions only if required

This order resolves most issues without ever touching packet captures.

Related Firewall Content on This Site

See Palo Alto config backup, Palo Alto master key with HA and Juniper SRX internet setup.

原文链接：https://azeemsecurity.com/security-engineering/paloalto/useful-commands/