Try a different search term or clear the filter.
clear {audit-comment | policy-app-usage-data | rule-hit-count}
clear audit-comment
Clear audit comment for an xpath
clear policy-app-usage-data
Clear Policy App Usage Data
clear rule-hit-count
Clear policy rule hit-count information
clear high-availability {control-link | transitions}
clear high-availability control-link
Clear high-availability control-link information
clear high-availability transitions
Clear high-availability transition statistics
clear job id <value>
| Parameter | Description |
|---|---|
<value> |
<0-4294967295> |
clear job id <value>
id
clear log {acc | alarm | config | hipmatch | system}
clear log acc
ACC database
clear log alarm
Alarm logs
clear log config
Configuration logs
clear log hipmatch
Hipmatch logs
clear log system
System logs
clear log-collector stats {runtime | searchengine}
clear log-collector stats runtime
Reset runtime statistics
clear log-collector stats searchengine
Reset runtime statistics
clear plugins aws {counters}
clear query {all-by-session | id <value>}
| Parameter | Description |
|---|---|
<value> |
<0-4294967295> |
clear query all-by-session
All queries for this session
clear query id <value>
id
clear report {all-by-session | cache | id <value>}
| Parameter | Description |
|---|---|
<value> |
<0-4294967295> |
clear report all-by-session
All reports for this session
clear report cache
All reports cache
clear report id <value>
id
clear reportd logging-service {jobs | stats}
clear reportd logging-service jobs
All logging-service jobs
clear reportd logging-service stats
All logging-service stats
clear user-cache-mp {all | ip <ip/netmask>}
| Parameter | Description |
|---|---|
<ip/netmask> |
<ip/netmask> |
clear user-cache-mp all
Clear all ip to user cache in management plane
clear user-cache-mp ip <ip/netmask>
Clear the specified ip to user cache in management plane
commit-all log-collector-config
commit-all log-collector-config
log-collector-config
commit-all firewall-cluster devices <value>
| Parameter | Description |
|---|---|
<value> |
device name |
commit-all firewall-cluster devices <value>
devices
commit-all template device <value>
| Parameter | Description |
|---|---|
<value> |
device name |
commit-all template device <value>
device
commit-all template validate-only {no | yes}
commit-all template validate-partial device <value>
| Parameter | Description |
|---|---|
<value> |
device name |
commit-all template validate-partial device <value>
device
commit-all template-stack {admin <value> | device <value>}
| Parameter | Description |
|---|---|
<value> |
member value |
commit-all template-stack admin <value>
Admin/s whose changes you want to push
commit-all template-stack device <value>
device
commit-all template-stack validate-only {no | yes}
commit-all template-stack validate-partial {admin <value> | device <value>}
| Parameter | Description |
|---|---|
<value> |
member value |
commit-all template-stack validate-partial admin <value>
Admin/s whose changes you want to push
commit-all template-stack validate-partial device <value>
device
commit-all wildfire-appliance-config {wildfire-appliance <value> | wildfire-appliance-cluster <value>}
| Parameter | Description |
|---|---|
<value> |
wildfire appliance name |
commit-all wildfire-appliance-config wildfire-appliance <value>
wildfire appliance name
commit-all wildfire-appliance-config wildfire-appliance-cluster <value>
wildfire appliance cluster name
configure
debug {list-admin-history | list-blocked-partial-xpaths}
debug list-admin-history
Show admin history for xpaths in journal
debug list-blocked-partial-xpaths
Show blocked xpaths
debug authentication {api-key-show | clear-tacacs-acct-stats | connection-debug-off | connection-debug-on | connection-show | off | set-tacacs-acct-task-q-size | show | show-active-requests | show-pending-requests | show-tacacs-acct-stats | test-tacacs-acct-server-connection}
debug authentication api-key-show
Show the content and validaty of the API key
debug authentication clear-tacacs-acct-stats
Clear TACACS+ acct stats
debug authentication connection-debug-off
Disable debug on connection for a specific type or a connection id or all
debug authentication connection-debug-on
Enable debug on connection for a specific type or a connection id or all
debug authentication connection-show
Show connection for a specific type or a connection id or all
debug authentication off
Turn off debug logging
debug authentication set-tacacs-acct-task-q-size
Set TACACS+ acct task queue size...requires authd restart after change to make it effective
debug authentication show
Display current debug logging setting
debug authentication show-active-requests
Show active auth request
debug authentication show-pending-requests
Show pending auth request
debug authentication show-tacacs-acct-stats
Show TACACS+ acct stats
debug authentication test-tacacs-acct-server-connection
Test TACACS+ acct server connectivty
debug authentication on {debug}
debug authentication on dump
Output all logs
debug authentication on error
Only output error logs
debug authentication on info
Only output error, warning and info logs
debug authentication on warn
Only output error and warning logs
debug cache {clear | show}
debug cache clear
clear the cache
debug cache show
show
debug cli {detail | exclude-completion | include-completion | off | on | show}
debug cli detail
detail
debug cli exclude-completion
exclude-completion
debug cli include-completion
include-completion
debug cli off
off
debug cli on
on
debug cli show
show
debug cloud-appid ace-server <value>
| Parameter | Description |
|---|---|
<value> |
specify server address |
debug cloud-appid ace-server <value>
temporarily set ACE cloud server
debug cloud-appid cloud-manual-pull {application <value> | check-cloud-app-data | check-cloud-signatures | cookie-base64 <value> | cookie-base64-and-store <value> | generate-cookie <value> | signature-appid <value> | signature-id <value>}
| Parameter | Description |
|---|---|
<value> |
cloud application id |
debug cloud-appid cloud-manual-pull application <value>
cloud application id
debug cloud-appid cloud-manual-pull check-cloud-app-data
check and restore cloud-app data from cloud server
debug cloud-appid cloud-manual-pull check-cloud-signatures
check and restore signatures from cloud server
debug cloud-appid cloud-manual-pull cookie-base64 <value>
fetch cloud data with specific cookie
debug cloud-appid cloud-manual-pull cookie-base64-and-store <value>
fetch cloud data and store locally
debug cloud-appid cloud-manual-pull generate-cookie <value>
generate cookie in base64 format
debug cloud-appid cloud-manual-pull signature-appid <value>
cloud application id
debug cloud-appid cloud-manual-pull signature-id <value>
cloud application/threat/filter signature id
debug cloud-appid delete-signature-data {appid}
| Parameter | Description |
|---|---|
<value> |
cloud application name |
debug cloud-appid delete-signature-data app-name <value>
cloud application name
debug cloud-appid delete-signature-data filter-signature-id <value>
cloud filter signature id
debug cloud-appid dump config
debug cloud-appid dump config
cloud app internal config on firewall
debug cloud-appid keep-task-file {no | yes}
debug cloud-appid keep-task-file no
remove all task files
debug cloud-appid keep-task-file yes
keep task files for a week(default)
debug cloud-appid reset {cloud-app-data | connection-to-cloud | force-cad-rebuild | force-data-integrity-check | force-memory-gc | pending-request-dp | reload-cloud-data | signature-dp | task-record}
debug cloud-appid reset cloud-app-data
remove all cloud application data, including application, container and metadata
debug cloud-appid reset connection-to-cloud
reset connection to cloud app server
debug cloud-appid reset force-cad-rebuild
force devsrvr to rebuild tdb for cloud app signatures
debug cloud-appid reset force-data-integrity-check
check cloud data integrity
debug cloud-appid reset force-memory-gc
trigger memory garbage collector to release unused memory
debug cloud-appid reset pending-request-dp
remove all signature requests
debug cloud-appid reset reload-cloud-data
reload cloud-app data from disk files
debug cloud-appid reset signature-dp
remove all cloud signatures
debug cloud-appid reset task-record
remove all historic task info in memory
debug cloud-appid set config <value>
| Parameter | Description |
|---|---|
<value> |
config in json format |
debug cloud-appid set config <value>
cloud internal config
debug cloud-appid unknown-signature-query {app-name <value> | appid <value> | filter-sig-id <value>}
| Parameter | Description |
|---|---|
<value> |
cloud application name |
debug cloud-appid unknown-signature-query app-name <value>
cloud application name
debug cloud-appid unknown-signature-query appid <value>
cloud application id
debug cloud-appid unknown-signature-query filter-sig-id <value>
cloud filter signature id
debug cloud-userid {reset-connection | reset-counters}
debug cloud-userid reset-connection
Reset connection to the cloud
debug cloud-userid reset-counters
Reset cloud user-id counters
debug cluster-userid reset-counters
debug cluster-userid reset-counters
Reset cluster user-id counters
debug contentd status
debug contentd status
show content manager status
debug cord {off | show}
debug cord off
Turn off debug logging
debug cord show
Display current debug logging setting
debug cord corr-mgr {off | on | show | stats}
debug cord delete {db | events | instances}
debug cord delete db
Delete correlation db.
debug cord delete events
Delete correlation events
debug cord delete instances
Delete correlation instances
debug cord object-stats {set}
debug cord object-stats clear
Clear per object log correlation log collection stats
debug cord object-stats show
View correlation per object log collection stats
debug cord object-stats show-setting
Clear per object log correlation log collection stats
debug cord on {debug | dump | error | info | warn}
debug cord on debug
Only output error, warning, info and debug logs
debug cord on dump
Output all logs
debug cord on error
Only output error logs
debug cord on info
Only output error, warning and info logs
debug cord on warn
Only output error and warning logs
debug cord stats {clear | show}
debug cord stats clear
View correlation log collection stats
debug cord stats show
View correlation log collection stats
debug dau clear {database | iptags | stats}
debug dau clear database
Clear database entires for a device group
debug dau clear iptags
Clear ip-tag mappings on all firewalls under DG
debug dau clear stats
Clear stats
debug dau detailed-log {enable}
| Parameter | Description |
|---|---|
<value> |
<30-50> |
debug dau detailed-log disable
Disable detailed log
debug dau detailed-log max-size-in-mb <value>
max-size-in-mb
debug dau detailed-log no-filter
Remove debug filter
debug dau detailed-log phplogs-to-panlogs
Store php dau debug logs in panlogs
debug dau detailed-log with-filter
Set debug filter
debug dau settings {dau-purge-interval | device-group | ip-tag-aggr-interval}
debug dau settings dau-purge-interval
Dynamic address interval iptags purge interval
debug dau settings device-group
Send iptag mappings recursively to firewalls connected to children DGs
debug dau settings ip-tag-aggr-interval
Set aggregation intervals
debug dau show {tags}
debug dau show dau3-cache
Show update hash and aggregation hash
debug dau show job-queue-info
Show dynamic address update info during configd processing
debug dau show plugins
Show source plugins ino
debug dau show stats
Show stats
debug device-telemetry {off | on | refresh-dest-server}
debug device-telemetry off
Debug off
debug device-telemetry on
Debug on
debug device-telemetry refresh-dest-server
Reset the dest-server node
debug distributord {off | show}
debug distributord off
off
debug distributord show
show
debug distributord dump {distribute-statistics | relay-ipc-iotd | relay-ipc-useridd}
debug distributord dump relay
Dump relay data struct
debug distributord hip-relay {hip-report-dedup-cache-size | hip-report-in-cache-aging-interval}
debug distributord hip-relay reset-hip-report-dedup-cache
reset hip report dedup cache
debug distributord max-handle-concurrent-clients {host | ip-user}
debug distributord on {debug | dump | error | info | warn}
debug distributord on debug
debug
debug distributord on dump
dump
debug distributord on error
error
debug distributord on info
info
debug distributord on warn
warn
debug distributord redis-connection-pool {ip-user | other-data-types}
debug distributord relay {relay-ipc-iotd | relay-ipc-useridd | relay-mode}
debug distributord reset {redistribution-agent}
debug distributord reset relay-statistics
relay-statistics
debug distributord set {agent | client | distribute | relay}
debug distributord test debug-log-category
debug distributord test debug-log-category
test on debug log category
debug distributord unset {agent | client | distribute | relay}
debug dumplog {off | on}
debug dumplog off
off
debug dumplog on
on
debug elasticsearch {circuit-breaker | es-alias-mapping | es-state}
debug elasticsearch circuit-breaker
Change the circuit breaker limit
debug elasticsearch es-alias-mapping
Mapping of alias to indices for a given logtype
debug elasticsearch es-state
elasticsearch current state
debug elasticsearch es-query-depth {clear | set | show}
debug elasticsearch es-query-depth clear
Remove the sdb of es-query-depth
debug elasticsearch es-query-depth set
set ES query depth
debug elasticsearch es-query-depth show
ES query depth
debug elasticsearch es-restart {option}
debug elasticsearch es_reason_whitelist {add | clear | delete | show}
debug elasticsearch es_reason_whitelist add
add es error reason to the allow list
debug elasticsearch es_reason_whitelist clear
clear all the reasons in the allow list
debug elasticsearch es_reason_whitelist delete
delete es error reason to the allow list
debug elasticsearch es_reason_whitelist show
show all the reasons in the allow list
debug elasticsearch repair {close}
debug elasticsearch repair certs
Update ES certificates
debug elasticsearch repair scroll
Close all scroll contexts
debug elasticsearch repair unassigned
Fix unassigned shards
debug elasticsearch show {certs | shard-info | unassigned}
debug elasticsearch show certs
Show Certs used by ES
debug elasticsearch show shard-info
Show ES shard info
debug elasticsearch show unassigned
Show unassigned shards
debug evtmgr
debug evtmgr configd {show}
debug evtmgr configd debug-log
Enable debug for a feature
debug evtmgr configd msg-filter
Specify message debug fitler
debug evtmgr cord {show}
debug evtmgr cord debug-log
Enable debug for a feature
debug evtmgr cord msg-filter
Specify message debug fitler
debug evtmgr logd {show}
debug evtmgr logd debug-log
Enable debug for a feature
debug evtmgr logd msg-filter
Specify message debug fitler
debug evtmgr ms {authz | authz-allowed-log | authz-bypassed-log | authz-dropped-log | show | syslog-enabled}
debug evtmgr ms debug-log
Enable debug for a feature
debug evtmgr ms msg-filter
Specify message debug fitler
debug evtmgr reportd {show}
debug evtmgr reportd debug-log
Enable debug for a feature
debug evtmgr reportd msg-filter
Specify message debug fitler
debug evtmgr useridd {show}
debug evtmgr useridd debug-log
Enable debug for a feature
debug evtmgr useridd msg-filter
Specify message debug fitler
debug high-availability-agent {internal-dump | off | show}
debug high-availability-agent internal-dump
Dump internal state of agent
debug high-availability-agent off
Turn off debug logging
debug high-availability-agent show
Display current debug logging setting
debug high-availability-agent on {debug | dump | error | info | warn}
debug high-availability-agent on debug
Only output error, warning, info and debug logs
debug high-availability-agent on dump
Output all logs
debug high-availability-agent on error
Only output error logs
debug high-availability-agent on info
Only output error, warning and info logs
debug high-availability-agent on warn
Only output error and warning logs
debug iot clear-all {type}
debug iot disable-device-id {no | yes}
debug iot disable-device-id no
no
debug iot disable-device-id yes
yes
debug iot dump {relay-ipc-distributord}
debug iot dump relay
Dump relay data struct
debug iot global {on}
debug iot global counter
Show global counter information
debug iot global off
off
debug iot global show
show
debug iot icd {on | reset}
| Parameter | Description |
|---|---|
<value> |
key-value pair, eg: PAN_GRPC_DECRYPT=true |
debug iot icd key-value <value>
pass key-value pair to iot component
debug iot icd set-app-match-workers <value>
Number of threads doing app match
debug iot icd trigger-app-match
match filters to cloud apps
debug iot icd verdict-server <value>
set verdict server
debug iot memory {detail | summary}
debug iot memory detail
detail
debug iot memory summary
summary
debug iot relay-ipc-distributord {set | show}
debug log-collector {hints | hints-stats | inter-log-collector | logd-conn-cache | missing-blocks | missing-blocks-stats | purge-stats | vld | vldmgr | wb-cache}
debug log-collector hints
Show the hints stored on this Log collector
debug log-collector hints-stats
Show the stats on hints stored on this Log collector
debug log-collector inter-log-collector
Inter log collectors
debug log-collector logd-conn-cache
Show connections cached in logd
debug log-collector missing-blocks
Show the holes stored on VLD
debug log-collector missing-blocks-stats
Show the stats on holes stored on VLD
debug log-collector purge-stats
Show the stats on purging on VLD
debug log-collector vld
VLDs on log collector
debug log-collector vldmgr
VLD manager on log collector
debug log-collector wb-cache
Show the write blocks cached in memory waiting to be acknowledged by a remote Log Collector
debug log-collector contmgr status
debug log-collector contmgr status
show content manager status
debug log-collector log-collection-stats {clear | show}
debug log-collector log-flow counters
debug log-collector log-flow counters
show stats
debug log-collector redist {status}
debug log-collector redist start
Start redistribution
debug log-collector redist stop
Stop redistribution
debug log-collector stats {vld}
debug log-collector stats runtime
Show runtime statistics
debug log-collector stats searchengine
Show Search Engine statistics
debug log-collector stats storage
Show Storage statistics
debug log-collector tracing {clear | set}
debug log-collector tracing clear
Clear tracing
debug log-collector tracing set
Set tracing
debug log-collector vld-requeue-needed {no | yes}
debug log-collector vld-requeue-needed no
Disable requeue
debug log-collector vld-requeue-needed yes
Enable requeue
debug log-collector-group {log-flow-counters | redist | set | show}
debug log-collector-group log-flow-counters
Log flow counters
debug log-collector-group redist
Redistribution control
debug log-collector-group set
set log collector group debug attributes
debug log-collector-group show
show log collector group ring
debug log-output-need-utf8 {no | show | yes}
debug log-output-need-utf8 no
no
debug log-output-need-utf8 show
show
debug log-output-need-utf8 yes
yes
debug logd {max_total_msgs <value> | notifier_q_size <value> | summary_sleep_time_in_milliseconds <value>}
| Parameter | Description |
|---|---|
<value> |
<0-50000> Max total messages |
debug logd max_total_msgs <value>
Max total messages
debug logd notifier_q_size <value>
Default value = 256
debug logd summary_sleep_time_in_milliseconds <value>
set summary sleep time in milliseconds (0 - 1000)
debug logd contmgr status
debug logd contmgr status
show content manager status
debug logd corr-mgr {off | on | show | stats}
debug logd off {all | general | reset}
debug logd off all
Turn off all logging feature logs
debug logd off general
Turn off general debug logs
debug logd off reset
Reset logging debug level to default
debug logd on {debug}
debug logd on all
Output all logging feature logs
debug logd on dump
Output all logs
debug logd on error
Output error logs
debug logd on general
Output general logging feature logs
debug logd on info
Output error, warning and info logs
debug logd on warn
Output error and warning logs
debug logd param-tuning {syslog-threads | task-queue}
debug logd persecond_queue_stats {off | on | show}
debug logd persecond_queue_stats off
Disable persecond queue stat to log file
debug logd persecond_queue_stats on
Enable persecond queue stat to log file
debug logd persecond_queue_stats show
Show persecond queue stat enable/disable
debug logd queue_stats show
debug logd queue_stats show
Show logd queue_stats
debug logdb {check-report-caching-status | delete-cached-report-for-period | delete-report-cache | disable-report-caching | enable-report-caching | set-es-throttle-timer | set-heap-size | set-vld-max-rate-to-es | show-es-throttle-timer | show-es-upgrade-time | show-heap-size | show-queue-stats | show-vld-max-rate-to-es | single-node}
debug logdb check-report-caching-status
Show if report caching is enabled
debug logdb delete-cached-report-for-period
Delete cached report for a time period
debug logdb delete-report-cache
Delete all cached reports
debug logdb disable-report-caching
Disable report caching
debug logdb enable-report-caching
Enable report caching
debug logdb set-es-throttle-timer
Set throttle-timer interval settings
debug logdb set-heap-size
Set heap size for log process.
debug logdb set-vld-max-rate-to-es
Set vld-max-rate-to-es debug settings
debug logdb show-es-throttle-timer
Show throttle-timer interval value
debug logdb show-es-upgrade-time
Show remaining time for upgrading ES.
debug logdb show-heap-size
Show heap size for log process.
debug logdb show-queue-stats
Show VLD and ES statistics
debug logdb show-vld-max-rate-to-es
Show vld-max-rate-to-es debug settings
debug logdb single-node
Set master node in two node cluster
debug logdb disable-throttle-es {no | show | yes}
debug logdb disable-throttle-es no
no
debug logdb disable-throttle-es show
show
debug logdb disable-throttle-es yes
yes
debug logdb migrate-lc {start | status}
debug logdb migrate-lc start
Start logdb migration now.
debug logdb migrate-lc status
Show Upgrade Logdb Migration State
debug logdb persecond-queue-stats {off | on | show}
debug logdb persecond-queue-stats off
Disable persecond queue stat to log file
debug logdb persecond-queue-stats on
Enable persecond queue stat to log file
debug logdb persecond-queue-stats show
Show persecond queue stat enable/disable
debug management-server {access-domain | app-usage-data-purge | audit-comments | check-predef-hash | clear | conn | db-intervals | log-forwarding-stats | off | panorama-root-ca-info | rebuild-predef-hash | reset-cluster-idmap | rolledup-intervals | rule-hit-purge | secure-conn | show | show-cluster-idmap | show-predef-hash | sync-cluster-idmap | template-stack}
debug management-server access-domain
show access-domain info for debugging
debug management-server app-usage-data-purge
Purge app-usage data
debug management-server audit-comments
Debug commands for audit comments
debug management-server check-predef-hash
Check for cloud app references
debug management-server clear
Clear all debug logs
debug management-server conn
Print mgmt srvr conn entries
debug management-server db-intervals
Show available summary intervals for a given period
debug management-server log-forwarding-stats
Show log forwarding statistics
debug management-server off
Turn off debug logging
debug management-server panorama-root-ca-info
Show panorama root ca information
debug management-server rebuild-predef-hash
Rebuild cloud-appid database
debug management-server reset-cluster-idmap
Reset idmap for cluster
debug management-server rolledup-intervals
Show available summary rollups for a given period rolled up optimally
debug management-server rule-hit-purge
Purge rule hit-count data
debug management-server secure-conn
show secure connections related debug information.
debug management-server show
Display current debug logging setting
debug management-server show-cluster-idmap
Show idmap for cluster
debug management-server show-predef-hash
Show cloud-appid database
debug management-server sync-cluster-idmap
Sync idmap for cluster
debug management-server template-stack
Debug option for template-stack
debug management-server app-config-trigger {no | yes}
debug management-server app-config-trigger no
no
debug management-server app-config-trigger yes
yes
debug management-server app-usage {no | yes}
debug management-server app-usage no
no
debug management-server app-usage yes
yes
debug management-server autofocus {off | on}
debug management-server autofocus off
off
debug management-server autofocus on
on
debug management-server client {disable | enable}
debug management-server contmgr status
debug management-server contmgr status
show content manager status
debug management-server db-rollup {off | on}
debug management-server db-rollup off
disable database roll up
debug management-server db-rollup on
enable database roll up
debug management-server db-stats {collection | database}
debug management-server db-stats collection
collection
debug management-server db-stats database
database
debug management-server device-monitoring {disk-quota | enable}
| Parameter | Description |
|---|---|
<value> |
Reset DB for a device |
debug management-server device-monitoring reset-db <value>
Reset DB for a device
debug management-server dtm-task-threads {default | enhance}
debug management-server dtm-task-threads default
use default threads for dtm task pool
debug management-server dtm-task-threads enhance
enable extra threads for dtm task pool
debug management-server evtmgr {logd_proxy_q_size <value> | max_total_msgs <value> | set_conn_q_size <value>}
| Parameter | Description |
|---|---|
<value> |
<1-100000> Default value = 100000 |
debug management-server evtmgr logd_proxy_q_size <value>
Default value = 100000
debug management-server evtmgr max_total_msgs <value>
Default value = 500000
debug management-server evtmgr set_conn_q_size <value>
Per connection queue size [20-250]
debug management-server inter-log-collector status
debug management-server inter-log-collector status
Inter-Log collector thread status
debug management-server log-forwarding-congestion-ctrl {set}
debug management-server log-forwarding-congestion-ctrl show
show the setting
debug management-server malloc-options {disable | enable | show}
debug management-server malloc-options disable
disable malloc options
debug management-server malloc-options enable
enable malloc options
debug management-server malloc-options show
show malloc option setting
debug management-server memory {info | trim | verbose}
debug management-server memory info
info
debug management-server memory trim
trim
debug management-server memory verbose
verbose
debug management-server nsx {svm-upgrade}
debug management-server on {debug}
debug management-server on dump
Output all logs
debug management-server on error
Only output error logs
debug management-server on info
Only output error, warning and info logs
debug management-server on warn
Only output error and warning logs
debug management-server req-stats {disable | enable}
debug management-server req-stats disable
disable
debug management-server req-stats enable
enable
debug management-server rule-hit {no | yes}
debug management-server rule-hit no
no
debug management-server rule-hit yes
yes
debug management-server rule-hit-task-queue rule-hit-threads <value>
| Parameter | Description |
|---|---|
<value> |
<1-100> Default value = 5 |
debug management-server rule-hit-task-queue rule-hit-threads <value>
Default value = 5
debug management-server set {comm | dynupdsch | lock | mongo | panorama | proxy | server}
debug management-server set all
all
debug management-server summary-logs {flush-rate}
debug management-server summary-logs flush-options
Flush options for summary logs
debug management-server summary-logs show
show debug summary-logs details
debug management-server toggle-ui-notification {disable | enable}
debug management-server toggle-ui-notification disable
disable
debug management-server toggle-ui-notification enable
enable
debug management-server tracing {clear | gather | set}
debug management-server tracing clear
Clear tracing
debug management-server tracing gather
Gather traces
debug management-server tracing set
Set tracing
debug management-server ui-refresh {off | on | set | show}
debug management-server unset {comm | dynupdsch | lock | mongo | panorama | proxy | server}
debug management-server unset all
all
debug management-server user {bitmap | info}
debug management-server user bitmap
show admin bitmap for debugging
debug management-server user info
show user info for debugging
debug management-tunnel
debug management-tunnel restart {ipsec-daemon | tunnel <value>}
| Parameter | Description |
|---|---|
<value> |
Tunnel name to be restarted |
debug management-tunnel restart ipsec-daemon
Restart IPSec daemon
debug management-tunnel restart tunnel <value>
Tunnel name to be restarted
debug management-websrvr {clear-cache | clear-ui-db}
debug management-websrvr clear-cache
Clear Nginx webcache
debug management-websrvr clear-ui-db
Clear UI DB
debug management-websrvr backend {on}
debug management-websrvr backend off
Turn off debug logging
debug management-websrvr backend show
Display log level setting
debug md5sum_cache clear
debug md5sum_cache clear
clear the md5sum cache
debug mongo {clear | drop | stats}
debug mongo clear
manually delete data under db storage path
debug mongo drop
drop a database or collection
debug mongo stats
database stats
debug mongo repair {instance}
| Parameter | Description |
|---|---|
<value> |
repair a specific db in mdb |
debug mongo repair database <value>
repair a specific db in mdb
debug mongo repair disk-space
repair database disk space, for mdb ONLY
debug mongo repair isolate-repair
Only for repair DB fails due to not enough disk space, and retore disk space fails due to data crash, for mdb ONLY
debug object registered-ip {clear | redis-entry | show | test}
debug object registered-ip redis-clear
Clears registered-ip entries in the redis database
debug object registered-ip redis-stats
Show registered-ip stats in redis
debug object registered-ip redis-sync-from-useridd-cache
Syncs registered-ip entries from useridd deamon cache into redis. Distributord restart is recommended after this operation.
debug object registered-ip redis-sync-to-device-server
Syncs registered-ip from redis database to device server. Note: this is not applicable to Panaroma.
debug object registered-user {clear | show | test}
debug object-repository {rebuild | show}
debug object-repository rebuild
rebuild the repository
debug object-repository show
show
debug object-repository find-references object
debug object-repository find-references object
object
debug pancfg-directory-usage
debug pancfg-directory-usage clean {dynamic-updates | software-images}
debug pancfg-directory-usage clean config
Clean unused saved configurations
debug pancfg-directory-usage set {max-num-images}
debug pancfg-directory-usage set device-monitoring
Optimize device-monitoring data
debug pancfg-directory-usage set optimize-database-usage
Optimize mongo database disk usage
debug panorama-stats {connections | pending-requests | queue-stats}
debug panorama-stats connections
Show all connections
debug panorama-stats pending-requests
Show all pending requests
debug panorama-stats queue-stats
Display internal queue statistics
debug panorama-vld-mgr {clear-active-operations | reset-logging-disk}
debug panorama-vld-mgr clear-active-operations
Clears up all current operation's flags
debug panorama-vld-mgr reset-logging-disk
Reset logging disk
debug panorama-vld-mgr disk-statistics {start-test | status | stop-test}
debug panorama-vld-mgr disk-statistics start-test
Starts disk performance test
debug panorama-vld-mgr disk-statistics status
View status of most recent disk performance test
debug panorama-vld-mgr disk-statistics stop-test
Stops disk performance test
debug plugins aws {cloud-ngfw}
debug plugins aws debug-aws-orchestration
Debugging detail for aws orchestration
debug plugins aws set-bind-mount
set bind mount flag
debug plugins openconfig info
debug plugins openconfig info
Show info
debug report {detailed-states | progress-trackers}
debug report detailed-states
detailed-states
debug report progress-trackers
progress-trackers
debug reportd {set-timeout <value> | show}
| Parameter | Description |
|---|---|
<value> |
<300-18000> Set report timeout |
debug reportd set-timeout <value>
Set report timeout
debug reportd show
Display current debug logging setting
debug reportd contmgr status
debug reportd contmgr status
show content manager status
debug reportd corr-mgr {off | on | show | stats}
debug reportd memory show
debug reportd memory show
Show running report ctxt memory
debug reportd off {all | batch-mgr | cache | cache-detail | exec-mgr | general | job-kill | reset | search-engine-api | search-engine-cache-mgr | search-engine-query-detail | search-engine-query-normal | search-engine-report-mgr | search-engine-report-req | search-engine-report-resp | search-engine-req-resp | unified-log}
debug reportd off all
Turn off all report feature logs
debug reportd off batch-mgr
Turn off batch-mgr logs
debug reportd off cache
Turn off cache op logs
debug reportd off cache-detail
Turn off cache detail logs
debug reportd off exec-mgr
Turn off exec-mgr logs
debug reportd off general
Turn off general debug logs
debug reportd off job-kill
Turn off report job kill logs
debug reportd off reset
Reset reporting debug level to default
debug reportd off search-engine-api
Turn off search engine api logs
debug reportd off search-engine-cache-mgr
Turn off search-engine report cachemgr logs
debug reportd off search-engine-query-detail
Turn off search engine detail logs
debug reportd off search-engine-query-normal
Turn off search engine logs
debug reportd off search-engine-report-mgr
Turn off search-engine reportmgr logs
debug reportd off search-engine-report-req
Turn off search-engine report req logs
debug reportd off search-engine-report-resp
Turn off search-engine report resp logs
debug reportd off search-engine-req-resp
Turn off search-engine request response
debug reportd off unified-log
Output unified-logging feature logs
debug reportd on {all | batch-mgr | cache | cache-detail | debug | dump | error | exec-mgr | general | info | job-kill | search-engine-api | search-engine-cache-mgr | search-engine-query-detail | search-engine-query-normal | search-engine-report-mgr | search-engine-report-req | search-engine-report-resp | search-engine-req-resp | unified-log | warn}
debug reportd on all
Output all report feature logs
debug reportd on batch-mgr
Output batch-mgr logs
debug reportd on cache
Output cache op logs
debug reportd on cache-detail
Output detailed cache logs
debug reportd on debug
Output error, warning, info and debug logs
debug reportd on dump
Output all logs
debug reportd on error
Output error logs
debug reportd on exec-mgr
Output exec-mgr logs
debug reportd on general
Output general report feature logs
debug reportd on info
Output error, warning and info logs
debug reportd on job-kill
Output report job kill logs
debug reportd on search-engine-api
Turn on search engine api logs
debug reportd on search-engine-cache-mgr
Turn on search-engine report cachemgr logs
debug reportd on search-engine-query-detail
Turn on search engine detail logs
debug reportd on search-engine-query-normal
Turn on search engine logs
debug reportd on search-engine-report-mgr
Turn on search-engine report mgr logs
debug reportd on search-engine-report-req
Turn on search-engine report req logs
debug reportd on search-engine-report-resp
Turn on search-engine report resp logs
debug reportd on search-engine-req-resp
Turn on search engine request response
debug reportd on unified-log
Output unified-logging feature logs
debug reportd on warn
Output error and warning logs
debug reportd schedule-reports {clear | disable | enable | show}
debug reportd schedule-reports clear
clear
debug reportd schedule-reports disable
disable
debug reportd schedule-reports enable
enable
debug reportd schedule-reports show
show
debug reportd send-request-to-7k {no | show | yes}
debug reportd send-request-to-7k no
Only send query request to 7k running pre-8.0 software (default)
debug reportd send-request-to-7k show
Show the current setting for send-request-to-7k
debug reportd send-request-to-7k yes
Send query request to 7k regardless software version
debug ret-content-download-retry attempts <value>
| Parameter | Description |
|---|---|
<value> |
<1-3> Set content download retry attempts |
debug ret-content-download-retry attempts <value>
Set content download retry attempts
debug rpm
debug rpm asan {clean | disable | enable | generate-report | install | leak-dump | restart | show | uninstall}
debug rpm asan clean
Cleanup asan reports generated
debug rpm asan disable
Disable asan for configd
debug rpm asan enable
Enable asan for configd
debug rpm asan generate-report
Generate asan reports for TSF pick up
debug rpm asan install
Install asan rpm for configd
debug rpm asan leak-dump
Dump leak report for ASAN (works only when asan binary is running)
debug rpm asan restart
Start/Stop ASAN for configd
debug rpm asan show
Show current ASAN setting for configd
debug rpm asan uninstall
Uninstall asan rpm for configd
debug selective-push {disable | enable | show}
debug selective-push disable
Disable selective-push for configd
debug selective-push enable
Enable selective-push for configd
debug selective-push show
Show current selective-push setting for configd
debug set-content-download-retry attempts <value>
| Parameter | Description |
|---|---|
<value> |
<1-3> Set content download retry attempts |
debug set-content-download-retry attempts <value>
Set content download retry attempts
debug skip-cert-renewal-check-syslog {no | show | yes}
debug skip-cert-renewal-check-syslog no
no
debug skip-cert-renewal-check-syslog show
show
debug skip-cert-renewal-check-syslog yes
yes
debug skip-condor-reports {no | show | yes}
debug skip-condor-reports no
Send report requests to Condor devices
debug skip-condor-reports show
Show the setting
debug skip-condor-reports yes
Skip sending report requests to Condor devices
debug skip-policy-address-check {no | show | yes}
debug skip-policy-address-check no
no
debug skip-policy-address-check show
show
debug skip-policy-address-check yes
yes
debug skip-policy-edl-check {no | show | yes}
debug skip-policy-edl-check no
no
debug skip-policy-edl-check show
show
debug skip-policy-edl-check yes
yes
debug skip-policy-profile-check {no | show | yes}
debug skip-policy-profile-check no
no
debug skip-policy-profile-check show
show
debug skip-policy-profile-check yes
yes
debug skip-policy-profile-group-check {no | show | yes}
debug skip-policy-profile-group-check no
no
debug skip-policy-profile-group-check show
show
debug skip-policy-profile-group-check yes
yes
debug snmpd {off | sysd-timeout <value>}
| Parameter | Description |
|---|---|
<value> |
<8-100> Set sysd timeout for snmpd |
debug snmpd off
Turn off debug logging
debug snmpd sysd-timeout <value>
Set sysd timeout for snmpd
debug snmpd async {set}
debug snmpd async off
Turn off async fetch
debug snmpd async on
Turn on async fetch
debug snmpd async show
Show async fetch status
debug snmpd clear_persistence {entity | interface}
debug snmpd clear_persistence entity
Clear ENTITY-MIB persistence DB
debug snmpd clear_persistence interface
Clear IF-MIB persistence DB
debug snmpd on {debug | request-debug | sysd-debug}
debug snmpd on debug
Only output debug logs
debug snmpd on request-debug
Only output request debug logs
debug snmpd on sysd-debug
Only output sysd debug logs
debug snmpd sysd-disable-retry {no | yes}
debug snmpd sysd-disable-retry no
no
debug snmpd sysd-disable-retry yes
yes
debug software {fd-limit | no-fd-limit | no-phy-limit | no-pprof | no-virt-limit | phy-limit | pprof | restart | virt-limit}
debug software fd-limit
Set open fd limit
debug software no-fd-limit
Disable open fd limit
debug software no-phy-limit
Disable max physical memory(rss+swap) limit
debug software no-pprof
Disable pprof for the selected service
debug software no-virt-limit
Disable max virtual memory limit
debug software phy-limit
Set max physical memory(rss+swap) limit in KB
debug software pprof
Enable pprof for the selected service
debug software restart
Restart process
debug software virt-limit
Set max virtual memory limit in KB
debug software core {authd | configd | cord | dlsrvr | logd | management-server | mdb | reportd | snmpd | user-id | vld-0-0 | vld-1-0 | vld-10-0 | vld-11-0 | vld-2-0 | vld-3-0 | vld-4-0 | vld-5-0 | vld-6-0 | vld-7-0 | vld-8-0 | vld-9-0 | vldmgr | web-backend-cms | web-backend-ctx | web-backend-notify | web-server}
debug software core authd
authentication process
debug software core configd
configd process
debug software core cord
correlation process
debug software core dlsrvr
dlsrvr process
debug software core logd
logd process
debug software core management-server
Management server process
debug software core mdb
Mongo DB
debug software core reportd
reportd process
debug software core snmpd
snmp process
debug software core user-id
User-ID process
debug software core vld-0-0
VLD process for LD1
debug software core vld-1-0
VLD process for LD2
debug software core vld-10-0
VLD process for LD11
debug software core vld-11-0
VLD process for LD12
debug software core vld-2-0
VLD process for LD3
debug software core vld-3-0
VLD process for LD4
debug software core vld-4-0
VLD process for LD5
debug software core vld-5-0
VLD process for LD6
debug software core vld-6-0
VLD process for LD7
debug software core vld-7-0
VLD process for LD8
debug software core vld-8-0
VLD process for LD9
debug software core vld-9-0
VLD process for LD10
debug software core vldmgr
Web server process
debug software core web-backend-cms
Web backend server process for Panorama
debug software core web-backend-ctx
Web backend server process for Context Switches
debug software core web-backend-notify
Web backend server process for Notification Engine
debug software core web-server
Web server process
debug software disk-usage {aggressive-cleaning}
debug software disk-usage cleanup
system logfile cleanup
debug software disk-usage dagger-fds-cleaning
show files that were deleted but remain held open
debug software disk-usage dangling-fds
show files that were deleted but remain held open
debug software large-core show-reserved-space
debug software large-core show-reserved-space
show reserved space in MB for large core dumps
debug software resource {set | show}
debug software resource set
Set parameters for resource control
debug software resource show
show
debug software trace {configd | logd | management-server | mdb | reportd | user-id | vld-0-0 | vld-1-0 | vld-10-0 | vld-11-0 | vld-2-0 | vld-3-0 | vld-4-0 | vld-5-0 | vld-6-0 | vld-7-0 | vld-8-0 | vld-9-0 | vldmgr | web-backend-cms | web-backend-ctx | web-backend-notify | web-server}
debug software trace configd
configd daemon
debug software trace logd
logd daemon
debug software trace management-server
Management server process
debug software trace mdb
Mongo DB
debug software trace reportd
reportd daemon
debug software trace user-id
User-ID process
debug software trace vld-0-0
VLD process for LD1
debug software trace vld-1-0
VLD process for LD2
debug software trace vld-10-0
VLD process for LD11
debug software trace vld-11-0
VLD process for LD12
debug software trace vld-2-0
VLD process for LD3
debug software trace vld-3-0
VLD process for LD4
debug software trace vld-4-0
VLD process for LD5
debug software trace vld-5-0
VLD process for LD6
debug software trace vld-6-0
VLD process for LD7
debug software trace vld-7-0
VLD process for LD8
debug software trace vld-8-0
VLD process for LD9
debug software trace vld-9-0
VLD process for LD10
debug software trace vldmgr
VLD Manager process
debug software trace web-backend-cms
Web server process for Panorama
debug software trace web-backend-ctx
Web server process for Context Switches
debug software trace web-backend-notify
Web server process for Notification Engine
debug software trace web-server
Web server process
debug sslmgr {off | show | statistics | tar-all-crl}
debug sslmgr off
off
debug sslmgr show
show
debug sslmgr statistics
Show CRL/OCSP statistics
debug sslmgr tar-all-crl
Tar all CRL files
debug sslmgr delete {crl | ocsp}
debug sslmgr on {debug | dump | error | info | warn}
debug sslmgr on debug
debug
debug sslmgr on dump
dump
debug sslmgr on error
error
debug sslmgr on info
info
debug sslmgr on warn
warn
debug sslmgr save ocsp
debug sslmgr save ocsp
Save OCSP cache
debug sslmgr view {ocsp}
| Parameter | Description |
|---|---|
<value> |
View CRL cache |
debug sslmgr view crl <value>
View CRL cache
debug streaming-telemetry {set-logging-reporting-timeout <value> | show-region-list | show-schedule | show-schedule-path-list}
| Parameter | Description |
|---|---|
<value> |
<120-1200> Set logging/reporting timeout for streaming telemetry |
debug streaming-telemetry set-logging-reporting-timeout <value>
Set logging/reporting timeout for streaming telemetry
debug streaming-telemetry show-region-list
Show region_list for streaming-telemetry
debug streaming-telemetry show-schedule
Show schedule for streaming-telemetry
debug streaming-telemetry show-schedule-path-list
Show show-schedule-path-list for streaming-telemetry
debug swm {cancel | history | list | log | rebuild-content-db | revert | show | status | unlock}
debug swm cancel
Cancel pending changes to software packages
debug swm history
Show history of software install operations
debug swm list
List software versions available for install
debug swm log
Show log of PAN Software Manager
debug swm rebuild-content-db
Rebuild content database
debug swm revert
Revert back to previous running software packages
debug swm show
Show information of PAN Software Manager
debug swm status
Show status of PAN Software Manager
debug swm unlock
Unlock PAN Software Manager
debug sysd {prefix-query | process-query | summary}
debug sysd prefix-query
query sysd per-prefix information command
debug sysd process-query
query sysd per-process information command
debug sysd summary
show sysd debug information for tech-support
debug sysd top {fetch | modify}
debug sysd top fetch
query top sysd fetch users
debug sysd top modify
query top sysd modify users
debug syslog-params {reset-to-default-settings | settings | show}
debug syslog-params reset-to-default-settings
debug syslog-params reset to default settings
debug syslog-params settings
debug syslog-params settings
debug syslog-params show
debug syslog-params show
debug system {disk-partition-info | disk-sync | maintenance-mode}
debug system disk-partition-info
Get disk partition information
debug system disk-sync
Flush all writes out to disk
debug system maintenance-mode
Reboot the system to maintenance mode
debug system audit {disable | enable}
debug system audit show
Show state of Auditd and rule file
debug system policy-optimization {enable-cache}
debug system ssh-key-reset {all | high-availability | management}
debug system ssh-key-reset all
Reset high-availability and management SSH keys
debug system ssh-key-reset high-availability
Reset high-availability SSH keys
debug system ssh-key-reset management
Reset management SSH keys
debug tac-login {challenge | permanently-disable | response}
debug tac-login challenge
Get challenge value for tac-login
debug tac-login permanently-disable
Blocks all TAC login access to the device. Note: Disabling access will reduce the options for TAC when debugging.
debug tac-login response
Run verification of challenge response for tac-login
debug techsupport duts {add-search-dir <value> | off | on | reset-config | run | set-byte-threshold <value>}
| Parameter | Description |
|---|---|
<value> |
Add a directory to scan |
debug techsupport duts add-search-dir <value>
Add a directory to scan
debug techsupport duts off
Disable filesize scanning
debug techsupport duts on
Enable filesize scanning
debug techsupport duts reset-config
Undo custom config for techsupport duts
debug techsupport duts run
Run techsupport duts right now
debug techsupport duts set-byte-threshold <value>
Set nontrivial filesize in bytes
debug ui telemetry {disabled | enabled}
debug ui telemetry disabled
Disable Pendo
debug ui telemetry enabled
Enable Pendo
debug use-proxy-for-email-server {disabled | enabled | show}
debug use-proxy-for-email-server disabled
disabled
debug use-proxy-for-email-server enabled
enabled
debug use-proxy-for-email-server show
show
debug user-id {agent <value> | cluster-get-all | cluster-peer-ip <ip/netmask> | get | off}
| Parameter | Description |
|---|---|
<value> |
specify one agent |
<ip/netmask> |
<ip/netmask> |
debug user-id agent <value>
Debug agent
debug user-id cluster-get-all
Upload User-ID data to cluster
debug user-id cluster-peer-ip <ip/netmask>
Set Dot format Cluster peer IP address
debug user-id get
Display current debug logging setting
debug user-id off
Turn off debug logging
debug user-id agent-getall-rate {rate <value> | show}
| Parameter | Description |
|---|---|
<value> |
<0-100> number of get-all requests every minute |
debug user-id agent-getall-rate rate <value>
number of get-all requests every minute
debug user-id agent-getall-rate show
show
debug user-id clear {cloud-identity-engine | domain-map | email-cache | group | log}
debug user-id clear cloud-identity-engine
Clear cloud identity engine data
debug user-id clear domain-map
domain-map
debug user-id clear email-cache
Clear email cache
debug user-id clear group
Show user groups data
debug user-id clear log
Clear debug logs
debug user-id cluster-state {inactive | leader | non-leader}
debug user-id cluster-state inactive
Set cluster node state to inactive
debug user-id cluster-state leader
Set cluster node state to leader
debug user-id cluster-state non-leader
Set cluster node state to non-leader
debug user-id cp-redirect-host-v6 {clear | show | value <value>}
| Parameter | Description |
|---|---|
<value> |
IP address or host name that maps to an IPv6 address for redirect for captive portal |
debug user-id cp-redirect-host-v6 clear
clear
debug user-id cp-redirect-host-v6 show
show
debug user-id cp-redirect-host-v6 value <value>
IP address or host name that maps to an IPv6 address for redirect for captive portal
debug user-id disable-hip-ha {no | yes}
debug user-id disable-hip-ha no
no
debug user-id disable-hip-ha yes
yes
debug user-id disable-max-initial-wmi {off | on}
debug user-id disable-max-initial-wmi off
off
debug user-id disable-max-initial-wmi on
on
debug user-id dscd {on | subdomains}
debug user-id dscd off
Turn off dscd debug logging
debug user-id dump {cloud-identity-engine | email-cache | hip-profile-database | idmgr | memory | relay-ipc-distributord}
debug user-id dump cluster-state
Dump cluster state
debug user-id dump com
Dump com messages statistics
debug user-id dump conn-mgr
Dump user-id conn-mgr messages statistics
debug user-id dump domain-id-table
Dump Domain ID mapping
debug user-id dump domain-map
domain-map
debug user-id dump ha
Dump ha state
debug user-id dump hip-report
Dump hip-report
debug user-id dump ip-user-mapping-stats
Show IP user mapping counters
debug user-id dump log-stats
log-stats
debug user-id dump relay
Dump relay data struct
debug user-id dump state
Dump user-id daemon state
debug user-id dump uid-2-metadata
Dump uid to metadata mapping
debug user-id dump uid-2-primeuid
Dump alternate uid to Prime uid mapping
debug user-id dump uid-req-stats
uid-req-stats
debug user-id dump userPrefix-2-uid
Dump usernamePrefix to uid mapping
debug user-id dump xmlapi-stats
xmlapi-stats
debug user-id enforce-tsa-certificate-expiry-check {off | on}
debug user-id enforce-tsa-certificate-expiry-check off
off
debug user-id enforce-tsa-certificate-expiry-check on
on
debug user-id ha-send-retry-count {set-count <value> | show}
| Parameter | Description |
|---|---|
<value> |
<0-10> set HA send retry count when queue is full, default is 0 |
debug user-id ha-send-retry-count set-count <value>
set HA send retry count when queue is full, default is 0
debug user-id ha-send-retry-count show
show
debug user-id hip-redistribution {set-max-queries <value> | set-max-query-msgs <value> | show-max-queries | show-max-query-msgs}
| Parameter | Description |
|---|---|
<value> |
<64-16384> Set the max hip queries queued in useridd memory (default is 12288) |
debug user-id hip-redistribution set-max-queries <value>
Set the max hip queries queued in useridd memory (default is 12288)
debug user-id hip-redistribution set-max-query-msgs <value>
Set the max hip query messages sent to distributord each time (default is 512)
debug user-id hip-redistribution show-max-queries
Show the max hip queries queued in useridd memory
debug user-id hip-redistribution show-max-query-msgs
Show the max hip query messages sent to distributord each time
debug user-id id-gen-for-user-tag {off | on | show}
debug user-id id-gen-for-user-tag off
off
debug user-id id-gen-for-user-tag on
on
debug user-id id-gen-for-user-tag show
show
debug user-id idmgr {set-user-count-check-threshold <value> | show-user-count-check-threshold}
| Parameter | Description |
|---|---|
<value> |
<5-100> Set checking threshold of Idmgr user count difference in memory and redis (default is 10) |
debug user-id idmgr set-user-count-check-threshold <value>
Set checking threshold of Idmgr user count difference in memory and redis (default is 10)
debug user-id idmgr show-user-count-check-threshold
Show checking threshold of Idmgr user count difference in memory and redis
debug user-id l3svc-max-retry {rate <value> | show}
| Parameter | Description |
|---|---|
<value> |
<1000-900000> number of retries to fetch client request |
debug user-id l3svc-max-retry rate <value>
number of retries to fetch client request
debug user-id l3svc-max-retry show
show
debug user-id l3svc-max-write-retry {rate <value> | show}
| Parameter | Description |
|---|---|
<value> |
<0-750000> number of retries to write the response |
debug user-id l3svc-max-write-retry rate <value>
number of retries to write the response
debug user-id l3svc-max-write-retry show
show
debug user-id log-ip-tag-mapping {no | yes}
debug user-id log-ip-tag-mapping no
no
debug user-id log-ip-tag-mapping yes
yes
debug user-id log-ip-user-mapping {no | yes}
debug user-id log-ip-user-mapping no
no
debug user-id log-ip-user-mapping yes
yes
debug user-id log-user-tag-mapping {no | yes}
debug user-id log-user-tag-mapping no
no
debug user-id log-user-tag-mapping yes
yes
debug user-id measure-handle-messages-duration {show | start | stop}
debug user-id measure-handle-messages-duration show
Show duration measurement statistics of handling messages from distributord
debug user-id measure-handle-messages-duration start
Start to measure duration on handling messages from distributord
debug user-id measure-handle-messages-duration stop
Stop measure duration on handling messages from distributord
debug user-id on {debug | dump | error | info | warn}
debug user-id on debug
Only output error, warning, info and debug logs
debug user-id on dump
Output all logs
debug user-id on error
Only output error logs
debug user-id on info
Only output error, warning and info logs
debug user-id on warn
Only output error and warning logs
debug user-id query-unknown-ip {off | on}
debug user-id query-unknown-ip off
off
debug user-id query-unknown-ip on
on
debug user-id refresh {cloud-identity-engine}
debug user-id refresh dp-uid-gid
refresh dp's user group info
debug user-id refresh user-id
refetch from user-id agent
debug user-id regip-max-update-retry {clear | rate <value> | show}
| Parameter | Description |
|---|---|
<value> |
<30-60> number of seconds the user id deamon retries to update the registered IP Tag to device server before issuing syslog alarms |
debug user-id regip-max-update-retry clear
clear
debug user-id regip-max-update-retry rate <value>
number of seconds the user id deamon retries to update the registered IP Tag to device server before issuing syslog alarms
debug user-id regip-max-update-retry show
show
debug user-id relay-ipc-distributord {set | show}
debug user-id reset {cloud-identity-engine | device-group | user-id-agent}
debug user-id reset cluster-state
Reset svc/agent userid cluster state
debug user-id reset com
clear com messages statistics
debug user-id reset conn-mgr
clear conn-mgr messages statistics
debug user-id reset ip-user-mapping-stats
clear ip user mapping counters
debug user-id reset relay-statistics
relay-statistics
debug user-id reset user-id-manager
Clear id manager cache file
debug user-id resolve-fqdn-3p {off | on}
debug user-id resolve-fqdn-3p off
off
debug user-id resolve-fqdn-3p on
on
debug user-id save hip-profile-database
debug user-id save hip-profile-database
Save hip-profile db
debug user-id set {agent | base | features | hip | ldap | misc | relay | third-party | userid}
debug user-id set all
all
debug user-id test {agentless | cp-login | cp-logout | debug-log-category | gp-login | gp-logout | hip-profile-database | hip-update | idmgr-change-max | idmgr-restore-default-max | sso-login}
debug user-id test agentless
debug agentless user-id with wmic query
debug user-id test cp-login
Test captive-portal login
debug user-id test cp-logout
Test captive-portal logout
debug user-id test debug-log-category
test on debug log category
debug user-id test gp-login
Test GP login
debug user-id test gp-logout
Test GP logout
debug user-id test hip-profile-database
Test batch hip-profile db population
debug user-id test hip-update
Test sending hip update message to user-id collectors
debug user-id test idmgr-change-max
Test idmgr change max id
debug user-id test idmgr-restore-default-max
Test idmgr restore default max id
debug user-id test sso-login
Test sso login
debug user-id unset {agent | base | features | ldap | misc | relay | third-party | userid}
debug user-id unset all
all
debug user-id useridd-ha-max-user-group-size {clear | rate <value> | show}
| Parameter | Description |
|---|---|
<value> |
<1-100> max size of group data in MBs the user id deamon fetches from HA peer at a time |
debug user-id useridd-ha-max-user-group-size clear
clear
debug user-id useridd-ha-max-user-group-size rate <value>
max size of group data in MBs the user id deamon fetches from HA peer at a time
debug user-id useridd-ha-max-user-group-size show
show
debug user-id useridd-ha-max-user-groups-to-sync {clear | rate <value> | show}
| Parameter | Description |
|---|---|
<value> |
<1-50000> max number of groups the user id deamon fetches from HA peer at a time |
debug user-id useridd-ha-max-user-groups-to-sync clear
clear
debug user-id useridd-ha-max-user-groups-to-sync rate <value>
max number of groups the user id deamon fetches from HA peer at a time
debug user-id useridd-ha-max-user-groups-to-sync show
show
debug user-id wmic-dynamic-range {off | on}
debug user-id wmic-dynamic-range off
off
debug user-id wmic-dynamic-range on
on
debug vm-agent
debug vm-agent set interval <value>
| Parameter | Description |
|---|---|
<value> |
<0-120> Set heartbeat interval in seconds |
debug vm-agent set interval <value>
Set heartbeat interval in seconds
debug vm-agent show interval
debug vm-agent show interval
Show heartbeat interval in seconds
delete {admin-sessions | anti-virus | cluster <name> | content | core | core-large | debug-filter | device-group <name> | high-availability-key | high-availability-known-hosts | logo | migration-log | pcap | policy-cache | readonly | ssh-authentication-public-key | template <name> | template-stack <name> | unknown-pcap | user-file | user-group-cache | wf-private | wildfire | wildfire-appliance <value> | wildfire-appliance-cluster <value>}
| Parameter | Description |
|---|---|
<name> |
<name> |
<value> |
Wildfire appliance serial number |
delete admin-sessions
Delete all active administrative sessions
delete anti-virus
Remove anti-virus updates on disk
delete cluster <name>
cluster
delete content
Remove content updates on disk
delete core
Remove core files on disk
delete core-large
Remove core files saved on logdb
delete debug-filter
Remove debug packet capture files on disk
delete device-group <name>
device-group
delete high-availability-key
Remove high-availability peer encryption key
delete high-availability-known-hosts
Remove high-availability peer key entry from known hosts file
delete logo
Remove custom logo file
delete migration-log
delete log file created during migration
delete pcap
Remove packet capture files
delete policy-cache
Remove cached compilation of policy from disk
delete readonly
readonly
delete ssh-authentication-public-key
delete ssh-authentication public key
delete template <name>
template
delete template-stack <name>
Template Stack
delete unknown-pcap
Remove packet capture files for unknown sessions
delete user-file
Delete user account settings
delete user-group-cache
Delete user group cache files in disk
delete wf-private
Remove wildfire private updates on disk
delete wildfire
Remove wildfire updates on disk
delete wildfire-appliance <value>
WildFire appliance
delete wildfire-appliance-cluster <value>
WildFire appliance cluster
delete auth {radius-require-msg-authentic | remote-host-check | strict-username-check}
delete auth radius-require-msg-authentic
clear the radius-require-msg-authentic flag
delete auth remote-host-check
clear the remote-host-check flag
delete auth strict-username-check
clear the strict-username-check flag
delete config repo {file <value> | running-config}
| Parameter | Description |
|---|---|
<value> |
Named snapshot |
delete config repo file <value>
Named snapshot
delete config repo running-config
Versioned running config
delete config saved {<value> | elasticsearch}
| Parameter | Description |
|---|---|
<value> |
Filename |
delete config saved elasticsearch
2026/05/30 13:06:42 4.0K
delete dlsrvr {distribute | poll-interval | server}
delete dlsrvr distribute
Remove Deployment across HA setting
delete dlsrvr poll-interval
Use the default polling interval of download jobs
delete dlsrvr server
Remove the overridden server address used for deployment
delete hip-profile-database {all | check-delete-all-status | entry}
delete hip-profile-database all
all
delete hip-profile-database check-delete-all-status
check-delete-all-status
delete hip-profile-database entry
entry
delete hip-report {all | report}
delete hip-report all
Delete all hip-reports
delete hip-report report
report
delete license {key <value> | token-file <value>}
| Parameter | Description |
|---|---|
<value> |
File name |
delete license key <value>
File name
delete license token-file <value>
File name
delete plugins app-data {<value> | aws | cloudconnector | openconfig | sw_fw_license | vm_series}
| Parameter | Description |
|---|---|
<value> |
app-data value |
delete plugins app-data aws
aws
delete plugins app-data cloudconnector
cloudconnector
delete plugins app-data openconfig
openconfig
delete plugins app-data sw_fw_license
sw_fw_license
delete plugins app-data vm_series
vm_series
delete pprof management-plane
delete pprof management-plane
Management plane pprof
delete report {custom | predefined | summary}
delete report custom
custom
delete report predefined
predefined
delete report summary
summary
delete server cert
delete server cert
cert
delete software version <value>
| Parameter | Description |
|---|---|
<value> |
Version |
delete software version <value>
Version
exit
find
ftp
ftp export log {alarm | auth | config | data | decryption | globalprotect | gtp | iptag | sctp | system | threat | traffic | tunnel | url | userid | wildfire}
ftp export log alarm
alarm
ftp export log auth
auth
ftp export log config
config
ftp export log data
data
ftp export log decryption
decryption
ftp export log globalprotect
globalprotect
ftp export log gtp
gtp
ftp export log iptag
iptag
ftp export log sctp
sctp
ftp export log system
system
ftp export log threat
threat
ftp export log traffic
traffic
ftp export log tunnel
tunnel
ftp export log url
url
ftp export log userid
userid
ftp export log wildfire
wildfire
grep mp-log
grep mp-log
mp-log
less {db-log | es-1-log | es-2-log | es-log | mp-backtrace | mp-log | panrepo-log | plugins-log | webserver-log}
less db-log
db-log
less es-1-log
es-1-log
less es-2-log
es-2-log
less es-log
es-log
less mp-backtrace
mp-backtrace
less mp-log
mp-log
less panrepo-log
panrepo-log
less plugins-log
plugins-log
less webserver-log
webserver-log
less LargeCore-mp-backtrace {clear | commit-all | configure | debug | delete | exit | find | ftp | grep | less | monitoring | ping | quit | replace | request | request-batch | schedule | scp | set | show | ssh | tail | tcpdump | test | tftp | traceroute | view-pcap}
less LargeCore-mp-backtrace clear
Clear data
less LargeCore-mp-backtrace commit-all
Shared policy commit operations
less LargeCore-mp-backtrace configure
Manipulate software configuration information
less LargeCore-mp-backtrace debug
Debug and diagnose
less LargeCore-mp-backtrace delete
Remove files from hard disk
less LargeCore-mp-backtrace exit
Exit this session
less LargeCore-mp-backtrace find
Find CLI commands with keyword
less LargeCore-mp-backtrace ftp
Use ftp to export files
less LargeCore-mp-backtrace grep
Searches file for lines containing a pattern match
less LargeCore-mp-backtrace less
Examine debug file content
less LargeCore-mp-backtrace monitoring
Device Monitoring Operations
less LargeCore-mp-backtrace ping
Ping hosts and networks
less LargeCore-mp-backtrace quit
Exit this session
less LargeCore-mp-backtrace replace
replace device serial number
less LargeCore-mp-backtrace request
Make system-level requests
less LargeCore-mp-backtrace request-batch
run test command on devices
less LargeCore-mp-backtrace schedule
schedule test jobs
less LargeCore-mp-backtrace scp
Use scp to import / export files
less LargeCore-mp-backtrace set
Set operational parameters
less LargeCore-mp-backtrace show
Show operational parameters
less LargeCore-mp-backtrace ssh
Start a secure shell to another host
less LargeCore-mp-backtrace tail
Print the last 10 lines of debug file content
less LargeCore-mp-backtrace tcpdump
capture packets on management interface
less LargeCore-mp-backtrace test
verify system settings with test cases
less LargeCore-mp-backtrace tftp
Use tftp to import / export files
less LargeCore-mp-backtrace traceroute
Print the route packets take to network host
less LargeCore-mp-backtrace view-pcap
Examine packet capture file content
monitoring {cfg-send | external-input}
monitoring cfg-send
cfg-send
monitoring external-input
Input external monitoring info
ping
quit
replace
request {add-device-to-ha-cluster | address-update | analyze-shared-policy | bootstrap | check-site-license-status | check-xpaths | clean-replay | clear-commit-tasks | clone-variable-config | determine-new-applications | device-status | encryption-level | export-load-config-bundle | feature | fetch | get-application-status | get-disabled-applications | get-ha-cluster-config-for-device | http | list-content-downloads | log-fwd-ctrl | log-migration | log-migration-set-end | log-migration-set-start | log-migration-update-logger | master-key | metadata-regenerate | move-dg <value> | push-report-definitions | quota-enforcement | refresh-ha-cluster-config | resolve | retrieve-variable-object | server | set-application-status-recursive | upgrade-history | user-id}
| Parameter | Description |
|---|---|
<value> |
dgname |
request add-device-to-ha-cluster
Add device as cluster member
request address-update
Process a dynamic address update
request analyze-shared-policy
Show shadowed object analysis
request bootstrap
Bootstrap options
request check-site-license-status
Check site license status with Update Server
request check-xpaths
Check if xpath has children
request clean-replay
Purge entries from replay database
request clear-commit-tasks
Clear all commit tasks
request clone-variable-config
Clone variable definition of a device in Template Stack
request determine-new-applications
Determine new applications in content
request device-status
get status information from device to Panorama
request encryption-level
Change encryption level
request export-load-config-bundle
Export and load imported configuration to device
request feature
Enable/disable a feature
request fetch
fetch
request get-application-status
Get application status
request get-disabled-applications
List disabled applications in content
request get-ha-cluster-config-for-device
Get HA cluster configuration for a device
request http
Perform http config related changes
request list-content-downloads
List content downloads
request log-fwd-ctrl
control log forwarding to Panorama from a device
request log-migration
migrate log collector disks, for RMA only.
request log-migration-set-end
Set end for log migration explicitly, for RMA only.
request log-migration-set-start
Set start for log migration, for RMA only. The next Panorama commit sets end of log migration implicitly
request log-migration-update-logger
Create metadata for purging logs, for RMA only.
request master-key
Change masterkey
request metadata-regenerate
regenerate metadata for disk-array
request move-dg <value>
Move dg to a new hierarchy
request push-report-definitions
Push report definitions to devices
request quota-enforcement
Manually enforce disk quota enforcement for logs and pcaps
request refresh-ha-cluster-config
Refresh cluster configuration
request resolve
resolve address to ip address
request retrieve-variable-object
Retrieve value from device for variable object
request server
server cert
request set-application-status-recursive
Set application status
request upgrade-history
Show the software versions installed on input device.
request user-id
user-id
request address-expansion expand
request address-expansion expand
expand given object name.
request ai-security-endpoint
request ai-security-endpoint atp-service {clear | set | show}
request ai-security-endpoint atp-service clear
clear ai-security atp service endpoint
request ai-security-endpoint atp-service set
set ai-security atp service endpoint
request ai-security-endpoint atp-service show
show ai-security atp service endpoint
request ai-security-endpoint dlp-service {clear | set | show}
request ai-security-endpoint dlp-service clear
clear ai-security atp service endpoint
request ai-security-endpoint dlp-service set
set ai-security atp service endpoint
request ai-security-endpoint dlp-service show
show ai-security atp service endpoint
request anti-virus
request anti-virus downgrade {install}
request anti-virus upgrade {install}
request anti-virus upgrade check
Get information from PaloAlto Networks server
request anti-virus upgrade download
Download anti-virus packages
request anti-virus upgrade info
Show information about available anti-virus packages
request api key expiration
request api key expiration
Will force all of the API keys to expire immediately.
request authentication unlock-admin
request authentication unlock-admin
Unlock locked administrators
request authkey
request authkey add serial <value>
| Parameter | Description |
|---|---|
<value> |
member value |
request authkey add serial <value>
serial numbers
request authkey delete {<value> | Firewalls}
| Parameter | Description |
|---|---|
<value> |
delete a key |
request authkey delete Firewalls
Firewalls
request authkey list {<value> | Firewalls}
| Parameter | Description |
|---|---|
<value> |
list key(s) |
request authkey list Firewalls
Firewalls
request batch {deploy-master-key | multi-upload}
request batch deploy-master-key
Deploy masterkey from Panorama
request batch multi-upload
Upload multiple files
request batch address-update force-sync
request batch address-update force-sync
Request full sync for specific device
request batch anti-virus {eligible | install-previous | upload-install}
request batch anti-virus check
check available antivirus package versions
request batch anti-virus delete
Delete a given antivirus package
request batch anti-virus download
Download antivirus packages to panorama
request batch anti-virus info
Check available antivirus packages on panorama
request batch cellular {firmware}
request batch content {eligible | install-previous | upload-install}
request batch content check
check available content versions
request batch content delete
Delete a given content package
request batch content download
Download content packages to panorama
request batch content info
Check available content packages on panorama
request batch content scp-export
Use scp profile to export files
request batch content scp-import
Use scp profile to import files
request batch global-protect-client {activate | eligible | upload | upload-activate}
request batch global-protect-client check
Check available GlobalProtect client packages from PaloAlto Networks server
request batch global-protect-client delete
Delete a given GlobalProtect client package
request batch global-protect-client download
Download GlobalProtect client packages to panorama
request batch global-protect-client info
Check available GlobalProtect client packages on panorama
request batch global-protect-client scp-export
Use scp profile to export files
request batch license {deactivate}
request batch license activate
activate new license on given devices
request batch license info
Get license info for all manager devices on panorama
request batch license refresh
Refresh license check of given devices
request batch patch {apply | eligible | install | revert | upload | upload-install}
request batch patch check
Get available patch updates from PaloAlto Networks server
request batch patch delete
Delete a given software patch file
request batch patch download
Download software patch files to panorama
request batch patch info
Show information about available software patches
request batch patch scp-export
Use scp profile to export files
request batch patch scp-import
Use scp profile to import files
request batch plugin {eligible | install | upload | upload-install}
request batch plugin check
check available plugin versions
request batch plugin delete
Delete a given plugin package
request batch plugin download
Download plugin packages to panorama
request batch plugin info
Check available plugin packages on panorama
request batch reboot {devices | log-collectors}
request batch software {check | dependencies | eligible | info | install | upload | upload-install}
request batch software delete
Delete a given software package
request batch software download
Download software packages to panorama
request batch software scp-export
Use scp profile to export files
request batch software scp-import
Use scp profile to import files
request batch vpnclient {activate | eligible | upload | upload-activate}
request batch vpnclient check
Check available vpnclient packages from PaloAlto Networks server
request batch vpnclient delete
Delete a given vpnclient package
request batch vpnclient download
Download vpnclient packages to panorama
request batch vpnclient info
Check available vpnclient packages on panorama
request batch wf-content {eligible | install-previous | upload-install}
request batch wf-content check
Get information from PaloAlto Networks server
request batch wf-content delete
Delete a given wildfire metadata package
request batch wf-content download
Download wildfire metadata packages
request batch wf-content info
Show information about available wildfire metadata packages on panorama
request batch wildfire {eligible | install-previous | upload-install}
request batch wildfire check
check available wildfire package versions
request batch wildfire delete
Delete a given wildfire package
request batch wildfire download
Download wildfire packages to panorama
request batch wildfire info
Check available wildfire packages on panorama
request certificate {bulk-certs-show | bulk-import | fetch | generate-scep-client-cert | import-scep-ca-cert | is-blocked | renew | revoke}
request certificate bulk-certs-show
Display Certificate
request certificate bulk-import
Import certificates in bulk
request certificate fetch
Fetch device certificate
request certificate generate-scep-client-cert
Generate Client Certificate using SCEP
request certificate import-scep-ca-cert
Import SCEP CA Certificates
request certificate is-blocked
Check if certificate private key is blocked
request certificate renew
Renew certificate
request certificate revoke
Revoke certificate
request certificate gen-otp-req {devices}
request certificate gen-otp-req no-cert
all devices without device cert installed
request certificate generate {alt-email <value> | hostname <value> | ip <ip/netmask> | organization-unit <value>}
| Parameter | Description |
|---|---|
<value> |
member value |
<ip/netmask> |
<ip/netmask> |
request certificate generate alt-email <value>
Subject alternate Email type
request certificate generate hostname <value>
Subject alternate name DNS type
request certificate generate ip <ip/netmask>
Subject alternate name IP type
request certificate generate organization-unit <value>
Department
request certificate secure-bridge {disable | enable | show}
request certificate secure-bridge disable
Disable secure-bridge.
request certificate secure-bridge enable
Enable secure-bridge.
request certificate secure-bridge show
Show cert secure-bridge setting.
request certificate show-blocked {tpl | tpl-stack}
request certificate show-blocked panorama
panorama certificates
request cluster-member {add | delete | update}
request cluster-member add
Add new cluster member
request cluster-member delete
Delete cluster member
request cluster-member update
Update existing cluster member
request cluster-migration
request cluster-migration template {1-TPL-AWS-REGIONAL-USW2 | 2-TPL-AWS-GLOBAL-COMMON-BASELINE | 3-TPL-AWS-ADMINS-BASELINE | 4-TPL-AWS-GWLB-ARE-OVRLY-COMBINED | 4-TPL-AWS-GWLB-LRE-OVRLY | 4-TPL-AWS-GWLB-NON-OVRLY-CMB-DIS-ARE | 4-TPL-AWS-GWLB-NON-OVRLY-COMBINED | 4-TPL-AWS-GWLB-OVRLY-CMB-ARE | <value> | CLD-1-TPL-AWS-REGIONAL-USW2 | CLD-2-TPL-AWS-GLOBAL-COMMON-BASELINE | CLD-4-TPL-AWS-GWLB-OVRLY-COMBINED | TPL-CERT | USER-ID | iron-skillet}
| Parameter | Description |
|---|---|
<value> |
name of template |
request cluster-migration template 1-TPL-AWS-REGIONAL-USW2
1-TPL-AWS-REGIONAL-USW2
request cluster-migration template 2-TPL-AWS-GLOBAL-COMMON-BASELINE
2-TPL-AWS-GLOBAL-COMMON-BASELINE
request cluster-migration template 3-TPL-AWS-ADMINS-BASELINE
3-TPL-AWS-ADMINS-BASELINE
request cluster-migration template 4-TPL-AWS-GWLB-ARE-OVRLY-COMBINED
4-TPL-AWS-GWLB-ARE-OVRLY-COMBINED
request cluster-migration template 4-TPL-AWS-GWLB-LRE-OVRLY
4-TPL-AWS-GWLB-LRE-OVRLY
request cluster-migration template 4-TPL-AWS-GWLB-NON-OVRLY-CMB-DIS-ARE
4-TPL-AWS-GWLB-NON-OVRLY-CMB-DIS-ARE
request cluster-migration template 4-TPL-AWS-GWLB-NON-OVRLY-COMBINED
4-TPL-AWS-GWLB-NON-OVRLY-COMBINED
request cluster-migration template 4-TPL-AWS-GWLB-OVRLY-CMB-ARE
4-TPL-AWS-GWLB-OVRLY-CMB-ARE
request cluster-migration template CLD-1-TPL-AWS-REGIONAL-USW2
CLD-1-TPL-AWS-REGIONAL-USW2
request cluster-migration template CLD-2-TPL-AWS-GLOBAL-COMMON-BASELINE
CLD-2-TPL-AWS-GLOBAL-COMMON-BASELINE
request cluster-migration template CLD-4-TPL-AWS-GWLB-OVRLY-COMBINED
CLD-4-TPL-AWS-GWLB-OVRLY-COMBINED
request cluster-migration template TPL-CERT
TPL-CERT
request cluster-migration template USER-ID
USER-ID
request cluster-migration template iron-skillet
iron-skillet
request cluster-migration template-stack {<value> | AWS-GCPS-East2-NetworkStack | CLD-STK-AWS-COMBINED-AZ-A | CLD-STK-AWS-COMBINED-AZ-B | STK-AWS-ARE-COMBINED-AZ-A | STK-AWS-ARE-COMBINED-AZ-B | STK-AWS-ARE-INBOUND | STK-AWS-COMBINED-AZ-A | STK-AWS-COMBINED-AZ-C | STK-AWS-COMBINED-NON-OVRLY-AZ | STK-AWS-LRE-COMBINED-AZ-A}
| Parameter | Description |
|---|---|
<value> |
name of template-stack |
request cluster-migration template-stack AWS-GCPS-East2-NetworkStack
AWS-GCPS-East2-NetworkStack
request cluster-migration template-stack CLD-STK-AWS-COMBINED-AZ-A
CLD-STK-AWS-COMBINED-AZ-A
request cluster-migration template-stack CLD-STK-AWS-COMBINED-AZ-B
CLD-STK-AWS-COMBINED-AZ-B
request cluster-migration template-stack STK-AWS-ARE-COMBINED-AZ-A
STK-AWS-ARE-COMBINED-AZ-A
request cluster-migration template-stack STK-AWS-ARE-COMBINED-AZ-B
STK-AWS-ARE-COMBINED-AZ-B
request cluster-migration template-stack STK-AWS-ARE-INBOUND
STK-AWS-ARE-INBOUND
request cluster-migration template-stack STK-AWS-COMBINED-AZ-A
STK-AWS-COMBINED-AZ-A
request cluster-migration template-stack STK-AWS-COMBINED-AZ-C
STK-AWS-COMBINED-AZ-C
request cluster-migration template-stack STK-AWS-COMBINED-NON-OVRLY-AZ
STK-AWS-COMBINED-NON-OVRLY-AZ
request cluster-migration template-stack STK-AWS-LRE-COMBINED-AZ-A
STK-AWS-LRE-COMBINED-AZ-A
request cluster-push devices <value>
| Parameter | Description |
|---|---|
<value> |
device name |
request cluster-push devices <value>
devices
request cluster-update devices <value>
| Parameter | Description |
|---|---|
<value> |
device name |
request cluster-update devices <value>
devices
request commit-lock {add | remove}
request commit-lock add
Prevent other users from committing
request commit-lock remove
Release commit lock previosuly held
request config {diff | list}
request config diff
Compare commit versions
request config list
List the commit versions
request config-backup {file <value> | running-config}
| Parameter | Description |
|---|---|
<value> |
Named snapshot |
request config-backup file <value>
Named snapshot
request config-backup running-config
Versioned running config
request config-lock {add | remove}
request config-lock add
Prevent other users from changing configuration
request config-lock remove
Release config lock previously held
request content {downgrade | validity-check <value>}
| Parameter | Description |
|---|---|
<value> |
Request content validity check by version (Example: 123-456). |
request content downgrade
Perform content downgrade functions
request content validity-check <value>
Request content validity check by version (Example: 123-456).
request content upgrade {install}
request content upgrade check
Get information from PaloAlto Networks server
request content upgrade download
Download content packages
request content upgrade info
Show information about available content packages
request device-quarantine-list {add | delete}
request device-quarantine-list add
Add device to quarantine list
request device-quarantine-list delete
Delete device from quarantine list
request device-quarantine-list show {all | hostid <value> | serialno <value>}
| Parameter | Description |
|---|---|
<value> |
hostid of a device |
request device-quarantine-list show all
Show all devices
request device-quarantine-list show hostid <value>
hostid of a device
request device-quarantine-list show serialno <value>
serial number of a device
request device-telemetry {cancel-collect-now | collect-now | default-20min-interval | disable | disable-20min-interval | disable-5min-interval | enable | enable-20min-interval | enable-5min-interval | reload-config-now}
request device-telemetry cancel-collect-now
cancel-collect-now
request device-telemetry collect-now
Collect device telemetry data now
request device-telemetry default-20min-interval
default-20min-interval
request device-telemetry disable
Disable device telemetry
request device-telemetry disable-20min-interval
disable-20min-interval
request device-telemetry disable-5min-interval
disable-5min-interval
request device-telemetry enable
Enable device telemetry
request device-telemetry enable-20min-interval
enable-20min-interval
request device-telemetry enable-5min-interval
enable-5min-interval
request device-telemetry reload-config-now
reload-config-now
request global-protect-portal ticket
request global-protect-portal ticket
global-protect-portal agent user override ticket
request high-availability {convert-to-primary | session-reestablish}
request high-availability convert-to-primary
Convert this device to take ownership of configured NFS mount
request high-availability session-reestablish
Perform session reestablishment
request high-availability state {peer}
request high-availability state functional
Set local HA state to a functional state
request high-availability state suspend
Set local HA state to suspended
request high-availability sync-to-remote {candidate-config | clock | running-config | ssh-key}
request high-availability sync-to-remote candidate-config
Sync candidate configuration to peer
request high-availability sync-to-remote clock
Sync the local time and date to the peer
request high-availability sync-to-remote running-config
Sync running configuration to peer
request high-availability sync-to-remote ssh-key
Sync ha ssh key to peer
request hsm {authenticate | client-version | login | mkey-wrapping-key-rotation | reset | restart-connection | rfs-setup | rfs-sync | server-enroll <value> | support-info}
| Parameter | Description |
|---|---|
<value> |
Enter nShield Connect HSM server name to enroll server |
request hsm authenticate
Authenticate Luna SA HSM server
request hsm client-version
HSM client version
request hsm login
Luna SA HSM login
request hsm mkey-wrapping-key-rotation
Encrypt mkey with a new wrapping key on HSM
request hsm reset
Clean up HSM client side data: cert, key files, cache, etc.
request hsm restart-connection
Restart crypto process to reinitialize HSM connection with lastest certificates and login credential.
request hsm rfs-setup
Set up RFS for nShield Connect
request hsm rfs-sync
Get update from rfs for nShield Connect
request hsm server-enroll <value>
Enter nShield Connect HSM server name to enroll server
request hsm support-info
Create HSM support info. Only valid for Luna SA
request hsm ha {create-ha-group | recover | replace-server | synchronize}
request hsm ha create-ha-group
HSM create HA group
request hsm ha recover
Allow a previously removed member to rejoin an HA group, or a new appliance to replace a member that failed and was removed.
request hsm ha replace-server
Replace one HSM server in the HA group
request hsm ha synchronize
HSM synchronize the contents of members of the HA group
request iot validity-check <value>
| Parameter | Description |
|---|---|
<value> |
Request iot validity check by version (Example: 123-456). |
request iot validity-check <value>
Request iot validity check by version (Example: 123-456).
request iot upgrade {check | info}
request iot upgrade check
Get information from PaloAlto Networks server
request iot upgrade info
Show information about available iot packages
request license {add-serial-number | deactivate | del-serial-number | fetch | fetch-tokens | info | install | tokens-info}
request license add-serial-number
Add CN-Series serial number and token license to CSP
request license deactivate
Deactivate license(s)
request license del-serial-number
Delete CN-Series serial number and token license to CSP
request license fetch
Get new license(s) using an authentication code
request license fetch-tokens
Get new license(s) using an authentication code
request license info
Show information about owned license(s)
request license install
Install a license key
request license tokens-info
Get license info for Token based licenses
request license api-key {delete | set | show}
request license api-key delete
Delete api-key
request license api-key set
Set api-key
request license api-key show
Show api-key
request license cms-license-store {info | refresh}
request license cms-license-store add
Add a given authcode to license store
request license cms-license-store delete
Delete a given authcode from license store
request license cms-license-store download
Download local license store tar file
request license cms-license-store fetch
Fetch License for a given authcode from license store
request license cms-license-store renew
Renew the given authcode from license store
request license cms-license-store upload
Upload local license store tar file
request licensing {argument-names <value> | arguments <value>}
| Parameter | Description |
|---|---|
<value> |
member value |
request licensing argument-names <value>
List of Variable Object
request licensing arguments <value>
List of Variable Object
request logdb {cleanup | downgrade | downgrade-in-progress | update-collector-group-after-replace}
request logdb cleanup
Cleanup logdb
request logdb downgrade
Migrate logdb to old version.
request logdb downgrade-in-progress
Downgrade in progress of logdb.
request logdb update-collector-group-after-replace
Update collector group after a logger is replaced
request logdb migrate {lc | vm}
request max-report-keys {set | show}
request max-report-keys set
set report max keys
request max-report-keys show
report max key limit
request min-report-keys {set | show}
request min-report-keys set
set report min keys
request min-report-keys show
report min key limit
request mongo {backup | restore}
request mongo backup
manually backup MongoDB data
request mongo restore
manually restore MongoDB data from backup files
request mongo set {backup-schedule | partition}
request mongo set storage-engine
set mongod storage engine
request mongo show {backup-schedule | databases | partition-path | storage-engine}
request mongo show backup-schedule
show current mongo backup schedule
request mongo show databases
show mongo database list
request mongo show partition-path
show current mongo backup data storage path
request mongo show storage-engine
show mongod storage engine
request password-change-history {dump-history | re-encrypt}
request password-change-history dump-history
Dump content of password history
request password-change-history re-encrypt
re-encrypt
request password-hash
request password-hash templatename {1-TPL-AWS-REGIONAL-USW2 | 2-TPL-AWS-GLOBAL-COMMON-BASELINE | 3-TPL-AWS-ADMINS-BASELINE | 4-TPL-AWS-GWLB-ARE-OVRLY-COMBINED | 4-TPL-AWS-GWLB-LRE-OVRLY | 4-TPL-AWS-GWLB-NON-OVRLY-CMB-DIS-ARE | 4-TPL-AWS-GWLB-NON-OVRLY-COMBINED | 4-TPL-AWS-GWLB-OVRLY-CMB-ARE | <value> | CLD-1-TPL-AWS-REGIONAL-USW2 | CLD-2-TPL-AWS-GLOBAL-COMMON-BASELINE | CLD-4-TPL-AWS-GWLB-OVRLY-COMBINED | TPL-CERT | USER-ID | iron-skillet}
| Parameter | Description |
|---|---|
<value> |
template name |
request password-hash templatename 1-TPL-AWS-REGIONAL-USW2
1-TPL-AWS-REGIONAL-USW2
request password-hash templatename 2-TPL-AWS-GLOBAL-COMMON-BASELINE
2-TPL-AWS-GLOBAL-COMMON-BASELINE
request password-hash templatename 3-TPL-AWS-ADMINS-BASELINE
3-TPL-AWS-ADMINS-BASELINE
request password-hash templatename 4-TPL-AWS-GWLB-ARE-OVRLY-COMBINED
4-TPL-AWS-GWLB-ARE-OVRLY-COMBINED
request password-hash templatename 4-TPL-AWS-GWLB-LRE-OVRLY
4-TPL-AWS-GWLB-LRE-OVRLY
request password-hash templatename 4-TPL-AWS-GWLB-NON-OVRLY-CMB-DIS-ARE
4-TPL-AWS-GWLB-NON-OVRLY-CMB-DIS-ARE
request password-hash templatename 4-TPL-AWS-GWLB-NON-OVRLY-COMBINED
4-TPL-AWS-GWLB-NON-OVRLY-COMBINED
request password-hash templatename 4-TPL-AWS-GWLB-OVRLY-CMB-ARE
4-TPL-AWS-GWLB-OVRLY-CMB-ARE
request password-hash templatename CLD-1-TPL-AWS-REGIONAL-USW2
CLD-1-TPL-AWS-REGIONAL-USW2
request password-hash templatename CLD-2-TPL-AWS-GLOBAL-COMMON-BASELINE
CLD-2-TPL-AWS-GLOBAL-COMMON-BASELINE
request password-hash templatename CLD-4-TPL-AWS-GWLB-OVRLY-COMBINED
CLD-4-TPL-AWS-GWLB-OVRLY-COMBINED
request password-hash templatename TPL-CERT
TPL-CERT
request password-hash templatename USER-ID
USER-ID
request password-hash templatename iron-skillet
iron-skillet
request password-hash templatestackname {<value> | AWS-GCPS-East2-NetworkStack | CLD-STK-AWS-COMBINED-AZ-A | CLD-STK-AWS-COMBINED-AZ-B | STK-AWS-ARE-COMBINED-AZ-A | STK-AWS-ARE-COMBINED-AZ-B | STK-AWS-ARE-INBOUND | STK-AWS-COMBINED-AZ-A | STK-AWS-COMBINED-AZ-C | STK-AWS-COMBINED-NON-OVRLY-AZ | STK-AWS-LRE-COMBINED-AZ-A}
| Parameter | Description |
|---|---|
<value> |
template stack name |
request password-hash templatestackname AWS-GCPS-East2-NetworkStack
AWS-GCPS-East2-NetworkStack
request password-hash templatestackname CLD-STK-AWS-COMBINED-AZ-A
CLD-STK-AWS-COMBINED-AZ-A
request password-hash templatestackname CLD-STK-AWS-COMBINED-AZ-B
CLD-STK-AWS-COMBINED-AZ-B
request password-hash templatestackname STK-AWS-ARE-COMBINED-AZ-A
STK-AWS-ARE-COMBINED-AZ-A
request password-hash templatestackname STK-AWS-ARE-COMBINED-AZ-B
STK-AWS-ARE-COMBINED-AZ-B
request password-hash templatestackname STK-AWS-ARE-INBOUND
STK-AWS-ARE-INBOUND
request password-hash templatestackname STK-AWS-COMBINED-AZ-A
STK-AWS-COMBINED-AZ-A
request password-hash templatestackname STK-AWS-COMBINED-AZ-C
STK-AWS-COMBINED-AZ-C
request password-hash templatestackname STK-AWS-COMBINED-NON-OVRLY-AZ
STK-AWS-COMBINED-NON-OVRLY-AZ
request password-hash templatestackname STK-AWS-LRE-COMBINED-AZ-A
STK-AWS-LRE-COMBINED-AZ-A
request phash-print
request phash-print superreader-status {disable | enable | show}
request phash-print superreader-status disable
Disable print starrified phash for superreader
request phash-print superreader-status enable
Enable print starrified phash for superreader
request phash-print superreader-status show
Show superreader starrified phash print status
request plugins {auto-upgrade | check | dau | debug | delete-package <value> | download | install <value> | quick-install <value> | reset-plugin | revert-install <value> | set | upload}
| Parameter | Description |
|---|---|
<value> |
delete-package value |
request plugins auto-upgrade
Enable/disable auto-upgrade of installed plugins
request plugins check
Get information from Palo Alto Networks server
request plugins dau
Enable/disable dau plugin
request plugins debug
Plugin debug settings
request plugins delete-package <value>
delete-package
request plugins download
Download plugin packages
request plugins install <value>
install
request plugins quick-install <value>
quick-install
request plugins reset-plugin
Reset Plugin
request plugins revert-install <value>
If set and install fails, current installed version will be reinstalled
request plugins set
Set global plugin options
request plugins upload
upload
request plugins aws {cloud-ngfw | resource-dg-mapping | tenant-dg-mapping}
request plugins aws app-account-cft
Show link to create the CFT template for application account
request plugins aws clear-aws-region
Clear AWS region set for IAMRole validation
request plugins aws create-cngfw-device-groups
create new device group.
request plugins aws create-cngfw-template-stack
create new template stack.
request plugins aws delete-deployment
Delete deployment.
request plugins aws eks-sync
Request a full sync of cluster objects.
request plugins aws find-tgw-details
Check if tgw is cross account or same account
request plugins aws get-app-account-list
Get all the application account name
request plugins aws get-availability-zones
Show availability zones for provided region.
request plugins aws get-aws-key-pairs
Show availabile AWS ssh keys.
request plugins aws get-bundle-instance-types
List bundle instance types.
request plugins aws get-byol-instance-types
Validate authcode for deployment.
request plugins aws get-custom-ami-ids
Show existing custom AMI IDs.
request plugins aws get-fw-metric-arn
Show firewall instance profile for provided iam role.
request plugins aws get-regions
Show valid AWS regions for the given IAM Role.
request plugins aws get-regions-for-monitoring
Show valid AWS regions for monitoring the given IAM Role.
request plugins aws get-software-versions
Show available software images from AWS Marketplace.
request plugins aws get-transit-gateways
Show existing transit gateways.
request plugins aws get-vpcs
Show VPCs for provided regions
request plugins aws iam-role-validate
Check validity of IAM Role.
request plugins aws launch-deployment
Launch deployment.
request plugins aws merge-eks-logs
Request all EKS plugin logs be merged into plugin_aws_eks_merged.log
request plugins aws merge-logs
Request all plugin logs be merged into plugin_aws_merged.log
request plugins aws prefetch-aws-resources
Get details of the specific region .
request plugins aws security-account-cft
Show link to create the CFT template for security account
request plugins aws set-aws-region
Set AWS region to use for IAMRole validation
request plugins aws set-tag-pruning-flag
Set tag pruning flag
request plugins aws show-aws-region
Show AWS region set for IAMRole validation
request plugins aws sync
Request a full sync of tags from AWS.
request plugins aws validate-shared-vpcs
Validate if only shared vpc-ids are reused
request plugins cloudconnector {disable | enable | resource-dg-mapping | tenant-dg-mapping}
request plugins cloudconnector cloud-ngfw-token
Request cloud-ngfw-token associated with a cloudngfw tenant.
request plugins openconfig {streaming_telemetry}
request plugins openconfig info
Request info
request plugins reset-password {<value> | aws | cloudconnector | openconfig | sw_fw_license | vm_series}
| Parameter | Description |
|---|---|
<value> |
reset-password value |
request plugins reset-password aws
aws
request plugins reset-password cloudconnector
cloudconnector
request plugins reset-password openconfig
openconfig
request plugins reset-password sw_fw_license
sw_fw_license
request plugins reset-password vm_series
vm_series
request plugins sw_fw_license {bootstrap-parameters | deactivate | offline-license}
request plugins sw_fw_license dgquery
turnoff dgquery.
request plugins uninstall {<value> | aws | cloudconnector | openconfig | sw_fw_license | vm_series}
| Parameter | Description |
|---|---|
<value> |
uninstall value |
request plugins uninstall aws
aws
request plugins uninstall cloudconnector
cloudconnector
request plugins uninstall openconfig
openconfig
request plugins uninstall sw_fw_license
sw_fw_license
request plugins uninstall vm_series
vm_series
request plugins vm_series {test}
request private-cloud-import node
request private-cloud-import node
node
request private-cloud-import cluster cluster-members <value>
| Parameter | Description |
|---|---|
<value> |
member serial number |
request private-cloud-import cluster cluster-members <value>
members of this cluster
request report-storage-size {set | show}
request report-storage-size set
set report storage size
request report-storage-size show
report storage size
request restart {software | system}
request restart software
Restart all system software
request restart system
Reboot the system
request routing {delete-config | migrate-config | show-config | show-error | show-logical-router | show-virtual-router}
request routing delete-config
Delete migrated routing configuration
request routing migrate-config
Migrate routing configuration to advanced-routing mode
request routing show-config
Show migrated advanced-routing configuration
request routing show-error
Show errors in migrated advanced-routing configuration
request routing show-logical-router
Show logical router list
request routing show-virtual-router
Show virtual router list
request shutdown system
request shutdown system
Shutdown the system
request stats dump
request stats dump
dump
request streaming-telemetry reload-config
request streaming-telemetry reload-config
reload-config
request support {check | info}
request support check
Get support information from PaloAlto Networks server
request support info
Show information about downloaded support information
request system private-data-reset
request system private-data-reset
Delete private data, keep software, content installations.
request system clone-system-disk {target}
request system disk {add | remove}
request system execute script
request system execute script
custom scripts
request system external-list {global-find | show}
request system external-list global-find
Returns Predefined IP list
request system external-list show
Print Predefined IP list
request system patch {apply | check | download | info | install | revert | scp-export | scp-import}
request system patch apply
Apply latest downloaded and installed software patch
request system patch check
Get information from PaloAlto Networks server
request system patch download
Download software patches
request system patch info
Show information about available software patches
request system patch install
Install a downloaded software patch
request system patch revert
Revert an installed and applied software patch
request system patch scp-export
Use scp profile to export files
request system patch scp-import
Use scp profile to import files
request system self-test {force-crypto-failure}
request system self-test crypto
Run crypto self-tests
request system self-test force-software-integrity-failure
Force a software integrity self-test failure
request system self-test software-integrity
Run software-integrity self-test
request system self-test-job {crypto | software-integrity}
request system self-test-job crypto
Run crypto self-tests job
request system self-test-job software-integrity
Run software-integrity self-test job
request system software {check | download | info | install}
request system software eligible
Download software packages
request system software scp-export
Use scp profile to export files
request system software scp-import
Use scp profile to import files
request system system-mode {logger | management-only}
request system system-mode logger
logger
request system system-mode management-only
management-only
request tech-support {copy-to-remote-host | dump}
request tech-support copy-to-remote-host
Copy the dumped tech-support file to remote host
request tech-support dump
dump
request ui telemetry {disabled | enabled}
request ui telemetry disabled
Disable Pendo
request ui telemetry enabled
Enable Pendo
request update-db jobs
request update-db jobs
Update jobs
request wf-private
request wf-private downgrade {install}
request wf-private upgrade {install}
request wf-private upgrade check
Get information from Wildfire Private Cloud server
request wf-private upgrade download
Download wildfire private cloud packages
request wf-private upgrade info
Show information about wildfire private cloud packages
request wildfire downgrade {install}
request wildfire upgrade {install}
request wildfire upgrade check
Get information from PaloAlto Networks server
request wildfire upgrade download
Download wildfire packages
request wildfire upgrade info
Show information about wildfire packages
request-batch
schedule uar-report
schedule uar-report
uar-report
schedule saas-applications-usage-report
schedule saas-applications-usage-report all {entry}
schedule saas-applications-usage-report selected-user-group entry
schedule saas-applications-usage-report selected-user-group entry
entry
schedule saas-applications-usage-report selected-zone {entry}
scp
scp export {application-block-page | captive-portal-text | certificate | cms-license-store | config-bundle | configuration | debug-pcap | device-state | device-telemetry | dnsproxy | file-block-continue-page | file-block-page | global-protect-portal-custom-help-page | global-protect-portal-custom-home-page | global-protect-portal-custom-login-page | global-protect-portal-custom-welcome-page | high-availability-key | hsm-client-cert | hsm-support-info | imported-config | license-token-file | logdb | mfa-login-page | mgmt-pcap | pdf-reports | sc3-backup | ssl-cert-status-page | ssl-optout-text | stats-dump | tech-support | telemetry-data | threat-pcap | ui-translation-mapping | url-block-page | url-coach-text | url-isolate-page | variable-config | virus-block-page | web-interface-certificate}
scp export application-block-page
Use scp to export application block comfort page
scp export captive-portal-text
Use scp to export captive portal text
scp export certificate
Use scp to export X.509 certificate
scp export cms-license-store
Use scp to export Panorama license store tar file
scp export config-bundle
Use scp to export configuration bundle
scp export configuration
Use scp to export configuration
scp export debug-pcap
Use scp to export packet capture generated for purpose of debugging daemons
scp export device-state
Use scp to export device-state
scp export device-telemetry
Use scp to export device-telemetry collect-now
scp export dnsproxy
Use tftp to export dnsproxy file
scp export file-block-continue-page
Use scp to export file block comfort page
scp export file-block-page
Use scp to export file block comfort page
scp export global-protect-portal-custom-help-page
Use scp to export global protect help page
scp export global-protect-portal-custom-home-page
Use scp to export GlobalProtect portal custom home page
scp export global-protect-portal-custom-login-page
Use scp to export global protect login page
scp export global-protect-portal-custom-welcome-page
Use scp to export global protect welcome page
scp export high-availability-key
Use scp to export high-availability peer encryption key
scp export hsm-client-cert
Use scp to export safenet hsm client certificate
scp export hsm-support-info
Use scp to export hsm support info file
scp export imported-config
Use scp to export imported configuration
scp export license-token-file
Use scp to export deactivate license token file
scp export logdb
Use scp to export logdb
scp export mfa-login-page
Use scp to export MFA login page
scp export mgmt-pcap
Use scp to export packet capture from management interface
scp export pdf-reports
Use scp to export PDF reports
scp export sc3-backup
Use scp to export Panorama sc3 migration tar file
scp export ssl-cert-status-page
Use scp to export SSL cert status page
scp export ssl-optout-text
Use scp to export ssl optout text
scp export stats-dump
Use scp to export AVR report data (default is last 7 days)
scp export tech-support
Use scp to export tech support info
scp export telemetry-data
Use scp to export sent telemetry data
scp export threat-pcap
Use scp to export threat packet capture
scp export ui-translation-mapping
Use scp to export UI translation mapping
scp export url-block-page
Use scp to export url block comfort page
scp export url-coach-text
Use scp to export url coach text
scp export url-isolate-page
Use scp to export url isolate response
scp export variable-config
Use scp to export variable definition config for template-stack
scp export virus-block-page
Use scp to export virus block comfort page
scp export web-interface-certificate
Use scp to export web-interface-certificate
scp export core-file {large-corefile | management-plane}
scp export core-file large-corefile
Use scp to export large core files in logdb
scp export core-file management-plane
Use scp to export control-plane core-file
scp export log {alarm | auth | config | data | decryption | globalprotect | gtp | iptag | sctp | system | threat | traffic | tunnel | url | userid | wildfire}
scp export log alarm
alarm
scp export log auth
auth
scp export log config
config
scp export log data
data
scp export log decryption
decryption
scp export log globalprotect
globalprotect
scp export log gtp
gtp
scp export log iptag
iptag
scp export log sctp
sctp
scp export log system
system
scp export log threat
threat
scp export log traffic
traffic
scp export log tunnel
tunnel
scp export log url
url
scp export log userid
userid
scp export log wildfire
wildfire
scp export log-file management-plane
scp export log-file management-plane
Use scp to export control-plane log-file
scp export pprof-file management-plane
scp export pprof-file management-plane
Use scp to export management-plane pprof-file
scp import {anti-virus | application-block-page | captive-portal-text | cellular-firmware | certificate | cms-license-store | configuration | content | credential-block-page | credential-coach-text | data-filter-block-page | deploy-software | file-block-continue-page | file-block-page | global-protect-portal-custom-help-page | global-protect-portal-custom-home-page | global-protect-portal-custom-login-page | global-protect-portal-custom-welcome-page | high-availability-key | hsm-ciphertrust-client-cert | hsm-ciphertrust-client-key | hsm-ciphertrust-server-cert | hsm-server-cert | idp-metadata | k8s-service-account | keypair | license | logdb | mfa-login-page | pan-url-db | patch | plugin | private-key | safe-search-block-page | saml-auth-internal-error-page | sc3-restore | software | ssl-cert-status-page | ssl-optout-text | ui-translation-mapping | url-block-page | url-coach-text | url-isolate-page | variable-config | virus-block-page | wildfire}
scp import anti-virus
Use scp to import anti-virus content
scp import application-block-page
Use scp to import application block comfort page
scp import captive-portal-text
Use scp to import captive portal text
scp import cellular-firmware
Use scp to import cellular firmware bundle
scp import certificate
Use scp to import X.509 certificate
scp import cms-license-store
Use scp to import Panorama License store tar file
scp import configuration
Use scp to import configuration
scp import content
Use scp to import database content
scp import credential-block-page
Use scp to import credential enforcement block comfort page
scp import credential-coach-text
Use scp to import credential enforcement coach text
scp import data-filter-block-page
Use scp to import data filter block page
scp import deploy-software
Use scp to import deploy software package
scp import file-block-continue-page
Use scp to import file block continue page
scp import file-block-page
Use scp to import file block page
scp import global-protect-portal-custom-help-page
Use scp to import GlobalProtect portal custom help page
scp import global-protect-portal-custom-home-page
Use scp to import GlobalProtect portal custom home page
scp import global-protect-portal-custom-login-page
Use scp to import GlobalProtect portal custom login page
scp import global-protect-portal-custom-welcome-page
Use scp to import GlobalProtect portal custom welcome page
scp import high-availability-key
Use scp to import high-availability peer encryption key
scp import hsm-ciphertrust-client-cert
Import CipherTrust Manager HSM client certificate
scp import hsm-ciphertrust-client-key
Import CipherTrust Manager HSM client key
scp import hsm-ciphertrust-server-cert
Import CipherTrust Manager HSM server CA certificate
scp import hsm-server-cert
Import HSM server certificate
scp import idp-metadata
import SAML IDP metadata
scp import k8s-service-account
Use scp to import kubernetes cluster service account json file
scp import keypair
Use scp to import X.509 key
scp import license
Use scp to import license file
scp import logdb
Use scp to import logdb
scp import mfa-login-page
Use scp to import MFA login page
scp import pan-url-db
Use scp to import Pan URL DB image
scp import patch
Use scp to import software patch package
scp import plugin
Use scp to import plugin package
scp import private-key
Use scp to import X.509 key
scp import safe-search-block-page
Use scp to import safe search block comfort page
scp import saml-auth-internal-error-page
Use scp to import saml auth internal error page
scp import sc3-restore
Use scp to import Panorama sc3 migration tar file
scp import software
Use scp to import software package
scp import ssl-cert-status-page
Use scp to import SSL cert status page
scp import ssl-optout-text
Use scp to import SSL optout text
scp import ui-translation-mapping
Use scp to import UI translation mapping
scp import url-block-page
Use scp to import url block comfort page
scp import url-coach-text
Use scp to import url coach text
scp import url-isolate-page
Use scp to import url isolate response
scp import variable-config
Use scp to import variable definition config for template-stack
scp import virus-block-page
Use scp to import virus block comfort page
scp import wildfire
Use scp to import wildfire content
set {audit-comment | clock | cluster <name> | customer-reference-id <value> | device-group <name> | device-inventory-upload | max-num-images | password | quarantine | readonly | reportd | serial-number <value> | ssh | ssh-authentication | syslog | template <name> | template-stack <name> | user-id | wildfire-appliance <value> | wildfire-appliance-cluster <value>}
| Parameter | Description |
|---|---|
<name> |
<name> |
<value> |
Set Customer Reference ID obtained from the support portal |
set audit-comment
Set audit comment for an xpath
set clock
Show system date and time
set cluster <name>
cluster
set customer-reference-id <value>
Set Customer Reference ID obtained from the support portal
set device-group <name>
device-group
set device-inventory-upload
Upload device csvfile
set max-num-images
Show maximum number of software or content images
set password
password
set quarantine
Quarantine XML API
set readonly
readonly
set reportd
reportd
set serial-number <value>
Panorama serial number/software license key
set ssh
SSH related configurations
set ssh-authentication
change ssh-authentication password
set syslog
syslog
set template <name>
template
set template-stack <name>
Template Stack
set user-id
User Identification XML API
set wildfire-appliance <value>
WildFire appliance
set wildfire-appliance-cluster <value>
WildFire appliance cluster
set auth radius-require-msg-authentic {no | yes}
set auth radius-require-msg-authentic no
no
set auth radius-require-msg-authentic yes
yes
set auth remote-host-check {no | yes}
set auth remote-host-check no
no
set auth remote-host-check yes
yes
set auth strict-username-check {no | yes}
set auth strict-username-check no
no
set auth strict-username-check yes
yes
set authentication radius-auth-type {auto | chap | pap}
set authentication radius-auth-type auto
RADIUS request type is CHAP with PAP fallback
set authentication radius-auth-type chap
RADIUS request type is CHAP
set authentication radius-auth-type pap
RADIUS request type is PAP
set authentication saml_signature_digest_algorithm {sha1 | sha224 | sha256 | sha384 | sha512}
set authentication saml_signature_digest_algorithm sha1
Digest algorithm is sha1, while signagure algorithm is rsa-sha1 or ecdsa-sha1 based on certificate algorithm
set authentication saml_signature_digest_algorithm sha224
Digest algorithm is sha224, while signagure algorithm is rsa-sha224 or ecdsa-sha224 based on certificate algorithm
set authentication saml_signature_digest_algorithm sha256
Digest algorithm is sha256, while signagure algorithm is rsa-sha256 or ecdsa-sha256 based on certificate algorithm
set authentication saml_signature_digest_algorithm sha384
Digest algorithm is sha384, while signagure algorithm is rsa-sha384 or ecdsa-sha384 based on certificate algorithm
set authentication saml_signature_digest_algorithm sha512
Digest algorithm is sha512, while signagure algorithm is rsa-sha512 or ecdsa-sha512 based on certificate algorithm
set cli {hide-ip | hide-user | timeout}
set cli hide-ip
Hide last octet of IP from logs
set cli hide-user
Hide user names from logs
set cli timeout
Set administrative session timeout values
set cli config-output-format {default | json | set | xml}
set cli config-output-format default
default
set cli config-output-format json
json
set cli config-output-format set
set
set cli config-output-format xml
xml
set cli confirmation-prompt {off | on}
set cli confirmation-prompt off
off
set cli confirmation-prompt on
on
set cli op-command-xml-output {off | on}
set cli op-command-xml-output off
off
set cli op-command-xml-output on
on
set cli pager {off | on}
set cli pager off
off
set cli pager on
on
set cli scripting-mode {off | on}
set cli scripting-mode off
off
set cli scripting-mode on
on
set cli terminal {type}
| Parameter | Description |
|---|---|
<value> |
<1-500> Set terminal height |
set cli terminal height <value>
Set terminal height
set cli terminal width <value>
Set terminal width
set device-inventory-edit add-device
set device-inventory-edit add-device
Add Device
set device-inventory-edit edit-devices device-list <value>
| Parameter | Description |
|---|---|
<value> |
MAC address (XX:XX:XX:XX:XX:XX) |
set device-inventory-edit edit-devices device-list <value>
List of Devices
set device-telemetry
set device-telemetry inherit-panorama-settings {all-template-stacks | template-stack}
set device-telemetry inherit-panorama-settings all-template-stacks
Apply to all template-stacks.
set device-telemetry inherit-panorama-settings template-stack
Apply to a template-stack instance.
set dlsrvr {poll-interval <value> | server <value>}
| Parameter | Description |
|---|---|
<value> |
<5-60> polling interval of download jobs in seconds |
set dlsrvr poll-interval <value>
polling interval of download jobs in seconds
set dlsrvr server <value>
override server address
set dlsrvr distribute {no | yes}
set dlsrvr distribute no
no
set dlsrvr distribute yes
yes
set management-server peer-timeout <value>
| Parameter | Description |
|---|---|
<value> |
<30-999999> Set mgmtsrvr peer timeout in seconds |
set management-server peer-timeout <value>
Set mgmtsrvr peer timeout in seconds
set management-server disable-tls1-0 {False | True}
set management-server disable-tls1-0 False
False
set management-server disable-tls1-0 True
True
set management-server logging {import-end | import-start | off | on}
set management-server logging import-end
Exit import mode
set management-server logging import-start
Enter import mode
set management-server logging off
Disallow logging
set management-server logging on
Allow logging
set ssl-conn-on-cert fail-all-conns {False | True}
set ssl-conn-on-cert fail-all-conns False
False
set ssl-conn-on-cert fail-all-conns True
True
set ssl-conn-on-cert fail-syslog-conns {False | True}
set ssl-conn-on-cert fail-syslog-conns False
override fail-all-conns for syslog connections
set ssl-conn-on-cert fail-syslog-conns True
ignored if fail-all-conns is False
set system
set system nfs dynamic-logging-partition
set system nfs dynamic-logging-partition
dynamic logging partition
set system setting {correlation | mp-memory-monitor | paloalto-networks-service-proxy | target | url-database}
| Parameter | Description |
|---|---|
<value> |
Default Wildfire Server |
set system setting default-wildfire-server <value>
Default Wildfire Server
show {admins | ai-security-profiles | api | clock | cloud-auth-service-alerts | cloud-auth-service-metadata | cloud-auth-service-profiles | cloud-auth-service-regions | cloud-auth-service-tenants | cluster <name> | clusters | collector-messages | commit-locks | config-locks | device-group <name> | device-group-tags | devicegroups | dg-hierarchy | dhcp | lcaas-status | license-token-files | log-collector-es-indices | management-clients | max-num-images | migration-log | netstat | ntp | obsolete-disabled-ssl-exclusions | operational-mode | panorama-certificates | readonly | reportd | rule-use | ssh-fingerprints | svm-device-cache | syslog-ssl-conn-validation | tag | template <name> | template-stack <name> | templates | threat | upgrade-history | usage}
| Parameter | Description |
|---|---|
<name> |
<name> | Pipe through a command |
show admins
Show active administrators
Admin From Client Session-start Idle-for Session-expiry
---------------------------------------------------------------------------------------------
* user-1 192.0.2.1 CLI 05/30/2026 20:06:29 00:00:00s 06/29/2026 20:06:29
show ai-security-profiles
AI Security Profiles
Invalid syntax.show api
All API related operations
Invalid syntax.show clock
Show system date and time
Sat May 30 20:06:38 EDT 2026
show cloud-auth-service-alerts
Get alerts from cloud authentication service profiles
CAS Alert request successful
show cloud-auth-service-metadata
Get cloud authentication service metadata for a region
Invalid syntax.show cloud-auth-service-profiles
Get cloud authentication service profiles of a tenant for a region
Invalid syntax.show cloud-auth-service-regions
Get cloud authentication service deployed regions
region id: gov
display name: United States - Government
fqdn(auth): host-1.example.local
fqdn(conf): host-2.example.local
region id: americas
display name: United States - Americas
fqdn(auth): host-3.example.local
fqdn(conf): host-4.example.local
region id: europe
display name: Netherlands - Europe
fqdn(auth): host-5.example.local
fqdn(conf): host-6.example.local
region id: uk
display name: United Kingdom
fqdn(auth): host-7.example.local
fqdn(conf): host-8.example.local
region id: sg
display name: Singapore
fqdn(auth): host-9.example.local
fqdn(conf): host-10.example.local
region id: ca
display name: Canada
fqdn(auth): host-11.example.local
fqdn(conf): host-12.example.local
region id: jp
display name: Japan
fqdn(auth): host-13.example.local
fqdn(conf): host-14.example.local
region id: au
display name: Australia
fqdn(auth): host-15.example.local
fqdn(conf): host-16.example.local
region id: de
display name: Germany
fqdn(auth): host-17.example.local
fqdn(conf): host-18.example.local
region id: il
display name: Israel
fqdn(auth): host-19.example.local
fqdn(conf): host-20.example.local
region id: in
display name: India
fqdn(auth): host-21.example.local
fqdn(conf): host-22.example.local
region id: ch
display name: Switzerland
fqdn(auth): host-23.example.local
fqdn(conf): host-24.example.local
region id: it
display name: Italy
fqdn(auth): host-25.example.local
fqdn(conf): host-26.example.local
region id: es
display name: Spain
fqdn(auth): host-27.example.local
fqdn(conf): host-28.example.local
region id: fr
display name: France
fqdn(auth): host-29.example.local
fqdn(conf): host-30.example.local
region id: pl
display name: Poland
fqdn(auth): host-31.example.local
fqdn(conf): host-32.example.local
region id: qa
display name: Qatar
fqdn(auth): host-33.example.local
fqdn(conf): host-34.example.local
region id: tw
display name: Taiwan
fqdn(auth): host-35.example.local
fqdn(conf): host-36.example.local
region id: id
display name: Indonesia
fqdn(auth): host-37.example.local
fqdn(conf): host-38.example.local
region id: kr
display name: Korea
fqdn(auth): host-39.example.local
fqdn(conf): host-40.example.local
region id: sa
display name: Saudi Arabia
fqdn(auth): host-41.example.local
fqdn(conf): host-42.example.local
region id: za
display name: South Africa
fqdn(auth): host-43.example.local
fqdn(conf): host-44.example.local
region id: br
display name: Brazil
fqdn(auth): host-45.example.local
fqdn(conf): host-46.example.local
region id: ae
display name: UAE
fqdn(auth): host-47.example.local
fqdn(conf): host-48.example.local
region id: in-del
display name: India - Delhi
fqdn(auth): host-49.example.local
fqdn(conf): host-50.example.local
region id: de-rg
display name: Germany - Regulated
fqdn(auth): host-51.example.local
fqdn(conf): host-52.example.local
maximum age: 3600 seconds
fetch time: Sat May 30 20:06:39 2026
show cloud-auth-service-tenants
Get cloud authentication service tenants for a region
Invalid syntax.show cluster <name>
cluster
show clusters
Show clusters
show collector-messages
Show log collector messages
Invalid syntax.show commit-locks
Show list of admins holding commit locks
DG/TPL Admin Created Last Activity Logged in?
--------------------------------------------------------------------------------
show config-locks
Show list commit locks
DG/TPL Admin Created Last Activity Logged in?
--------------------------------------------------------------------------------
show device-group <name>
device-group
show device-group-tags
show device group tags info
Invalid syntax.show devicegroups
Show device groups
==========================================================================
Group: DG-AWS-ARE-INBOUND Shared policy md5sum:d3e472fd7e27ac22ca45e6e255d55669
==========================================================================
Group: DG-AWS-LRE-COMBINED Shared policy md5sum:4604c80b7234c8ebfa066a0796716233
==========================================================================
Group: DG-AWS-COMBINED Shared policy md5sum:942bd78962dcb64edf995187945133ff
==========================================================================
Group: DG-AWS-ARE-COMBINED Shared policy md5sum:0901b55a11cba9770cd31bc4d300f551
==========================================================================
Group: CLD-DG-AWS-COMBINED Shared policy md5sum:568597177ea075094eb3f5be67d2bb59
Serial Hostname IPv4 IPv6 Connected
--------------------------------------------------------------------------
SERIAL000000013 host-59.example.local 192.0.2.4 unknown no
Wildfire Real-time Stream Disablednot deactivated last shared policy commit all state: commit succeeded with warnings
last shared policy commit all updated: 2026/05/30 14:37:02
last shared policy validate all state: none
last shared policy validate all updated: none
Local configuration size: 11 KB
Merged configuration size(local, panorama pushed, predefined): 18 MB
Predefined configuration size: 19 MB
Maximum recommended merged configuration size: 0 MB (0% configured)
shared policy md5sum: 568597177ea075094eb3f5be67d2bb59(In Sync)
shared policy new md5sum: 568597177ea075094eb3f5be67d2bb59(In Sync)
shared policy version: 146
VPN Disable Mode: no
Operational Mode: normal
Certificate Status:
Certificate subject Name:
Certificate expiry at:
Connected at:
Custom certificate Used:
Virtual Systems:
vsys1() shared policy md5sum:568597177ea075094eb3f5be67d2bb59(In Sync)
shared policy version:146
Last masterkey push status: Unknown
Last masterkey push timestamp: none
Express mode: no
Device cellular ports: 0
Device cert present :
Device cert expiry date : N/A
SERIAL000000014 host-58.example.local 192.0.2.5 unknown no
Wildfire Real-time Stream Disablednot deactivated last shared policy commit all state: commit succeeded with warnings
last shared policy commit all updated: 2026/05/30 14:37:03
last shared policy validate all state: none
last shared policy validate all updated: none
Local configuration size: 11 KB
Merged configuration size(local, panorama pushed, predefined): 18 MB
Predefined configuration size: 19 MB
Maximum recommended merged configuration size: 0 MB (0% configured)
shared policy md5sum: 568597177ea075094eb3f5be67d2bb59(In Sync)
shared policy new md5sum: 568597177ea075094eb3f5be67d2bb59(In Sync)
shared policy version: 146
VPN Disable Mode: no
Operational Mode: normal
Certificate Status:
Certificate subject Name:
Certificate expiry at:
Connected at:
Custom certificate Used:
Virtual Systems:
vsys1() shared policy md5sum:568597177ea075094eb3f5be67d2bb59(In Sync)
shared policy version:146
Last masterkey push status: Unknown
Last masterkey push timestamp: none
Express mode: no
Device cellular ports: 0
Device cert present :
Device cert expiry date : N/A
==========================================================================
Group: AWS-GCPS-East2 Shared policy md5sum:42052a59cf39bcf3c7b19e6c7477bc8f
==========================================================================
Group: DG-AWS Shared policy md5sum:4604c80b7234c8ebfa066a0796716233
show dg-hierarchy
Show device groups hierarchy
CLD-DG-AWS-COMBINED
DG-AWS
DG-AWS-ARE-INBOUND
DG-AWS-COMBINED
DG-AWS-ARE-COMBINED
DG-AWS-LRE-COMBINED
AWS-GCPS-East2
show dhcp
Show DHCP data
Invalid syntax.show lcaas-status
Show managed log collectors as a service
Invalid syntax.show license-token-files
Show license token files for manual license deactivation
Server error : No license token files existshow log-collector-es-indices
Show elastic search indices per cluster
health status index pri rep docs.count docs.deleted store.size pri.store.size
green open pan_20260505_7h_traffic_000710040832-0 1 0 SERIAL000000015 0 169.2mb 169.2mb
green open pan_20260501_7h_system_000710040832-0 1 0 6038 0 1.1mb 1.1mb
green open pan_20260425_7h_trsum_000710040832-0 1 0 431 0 436.2kb 436.2kb
green open pan_20260425_7h_threat_000710040832-0 1 0 161 0 248.5kb 248.5kb
green open pan_20260501_7h_config_000710040832-0 1 0 60 0 82.7kb 82.7kb
green open pan_20260529_7h_traffic_000710040832-0 1 0 26871 0 8.4mb 8.4mb
green open pan_20260506_7h_trsum_000710040832-0 1 0 14013 0 2.7mb 2.7mb
green open .pancache 1 0 205 0 174.5kb 174.5kb
green open pan_20260425_7h_traffic_000710040832-0 1 0 SERIAL000000016 0 65mb 65mb
green open pan_20260506_7h_urlsum_000710040832-0 1 0 6684 0 853.3kb 853.3kb
green open pan_20260425_7h_urlsum_000710040832-0 1 0 77 0 165.6kb 165.6kb
green open pan_20260401_7h_system_000710040832-0 1 0 4195 0 807.6kb 807.6kb
green open pan_20260506_7h_threat_000710040832-0 1 0 32168 0 8.7mb 8.7mb
green open pan_20260529_7h_trsum_000710040832-0 1 0 11 0 71.2kb 71.2kb
green open pan_20260401_7h_config_000710040832-0 1 0 59 0 94kb 94kb
Oldest indices:
pan_20260401_7h_config_000710040832-0
show management-clients
Show internal management server clients
Client PRI State Progress
-------------------------------------------------------------------------
ha_agent 25 P2-ok 100
sslmgr 10 P2-ok 100
authd 10 P2-ok 100
cryptod 10 P2-ok 100
dagger 10 init 0 (op cmds only)
cord 10 P2-ok 100
logd 10 P2-ok 100
reportd 10 P2-ok 100
useridd 10 P2-ok 100
distributord 10 P2-ok 100
iotd 10 P2-ok 100
Overall status: P2-ok. Progress: 0
Warnings:
Errors:
show max-num-images
Show maximum number of software or content images
Maximum images to keep is set to 5show migration-log
Show log file created during migration
Server error : Could not read migration log fileshow netstat
Print network connections and statistics
show ntp
Show NTP synchronization state
NTP state:
NTP not synched, using local clock
show obsolete-disabled-ssl-exclusions
Show disabled predefined ssl-decrypt exclusions not present in the installed content
Invalid syntax.show operational-mode
Show device operational mode
normalshow panorama-certificates
Show panorama certificate list
-rw-r--r-- 1 root root 3.4K Apr 21 22:38 client_007955000843631.pem
-rw-r--r-- 1 root root 3.4K Apr 21 22:38 client_007955000843632.pem
-rw-r--r-- 1 root root 3.4K Apr 24 14:02 client_007955000845607.pem
-rw-r--r-- 1 root root 3.4K Apr 24 14:02 client_007955000845608.pem
-rw-r--r-- 1 root root 3.4K Apr 24 17:00 client_007955000845666.pem
-rw-r--r-- 1 root root 3.4K Apr 24 17:00 client_007955000845667.pem
-rw-r--r-- 1 root root 3.4K Apr 24 23:14 client_007955000845714.pem
-rw-r--r-- 1 root root 3.4K Apr 24 23:15 client_007955000845715.pem
-rw-r--r-- 1 root root 3.4K Apr 25 00:14 client_007955000845718.pem
-rw-r--r-- 1 root root 3.4K Apr 25 00:14 client_007955000845719.pem
-rw-r--r-- 1 root root 3.4K Apr 25 17:14 client_007955000845820.pem
-rw-r--r-- 1 root root 3.4K Apr 25 17:14 client_007955000845821.pem
-rw-r--r-- 1 root root 3.4K Apr 26 14:52 client_007955000845933.pem
-rw-r--r-- 1 root root 3.4K May 5 10:31 client_007955000849682.pem
-rw-r--r-- 1 root root 3.4K May 5 10:31 client_007955000849683.pem
-rw-r--r-- 1 root root 3.4K May 5 10:31 client_007955000849684.pem
-rw-r--r-- 1 root root 3.4K May 5 10:31 client_007955000849685.pem
-rw-r--r-- 1 root root 3.4K May 5 15:48 client_007955000849853.pem
-rw-r--r-- 1 root root 3.4K May 5 15:59 client_007955000849858.pem
-rw-r--r-- 1 root root 3.4K May 20 17:32 client_007955000856986.pem
-rw-r--r-- 1 root root 3.4K May 28 10:00 client_007955000860503.pem
-rw-r--r-- 1 root root 3.4K May 28 10:00 client_007955000860504.pem
-rw-r--r-- 1 root root 3.4K May 28 17:05 client_007955000860882.pem
-rw-r--r-- 1 root root 3.4K May 28 17:05 client_007955000860883.pem
-rw-r--r-- 1 root root 3.4K May 29 00:09 client_007955000861034.pem
-rw-r--r-- 1 root root 3.4K May 29 00:09 client_007955000861035.pem
-rw-r--r-- 1 root root 3.4K May 30 13:43 client_007955000861692.pem
-rw-r--r-- 1 root root 3.4K May 30 13:43 client_007955000861693.pem
-rw-r--r-- 1 root root 3.3K Apr 11 07:07 server.pem
show readonly
readonly
show reportd
Show reportd Logging Service jobs
Invalid syntax.show rule-use
Show used/non-used policy rules
Invalid syntax.show ssh-fingerprints
Show management ssh public key fingerprints
Invalid syntax.show svm-device-cache
Show all managed SVM Devices
Invalid syntax.show syslog-ssl-conn-validation
Show syslog ssl connection validation settings
syslogng ssl connection validation settings:
all-conns: enforce
crl: enforce
ocsp: enforce
eku: enforce
show tag
Show dump of dynamic address tags for current session's device group
Invalid syntax.show template <name>
template
show template-stack <name>
Show template stack
==========================================================================
Template Stack: STK-AWS-ARE-COMBINED-AZ-A
Templates : [ 1-TPL-AWS-REGIONAL-USW2 2-TPL-AWS-GLOBAL-COMMON-BASELINE 3-TPL-AWS-ADMINS-BASELINE 4-TPL-AWS-GWLB-ARE-OVRLY-COMBINED ]
Cluster Enabled: no
==========================================================================
Template Stack: STK-AWS-ARE-INBOUND
Templates : [ 1-TPL-AWS-REGIONAL-USW2 2-TPL-AWS-GLOBAL-COMMON-BASELINE 3-TPL-AWS-ADMINS-BASELINE 4-TPL-AWS-GWLB-ARE-OVRLY-COMBINED ]
Cluster Enabled: no
==========================================================================
Template Stack: AWS-GCPS-East2-NetworkStack
Templates : [ 1-TPL-AWS-REGIONAL-USW2 2-TPL-AWS-GLOBAL-COMMON-BASELINE 3-TPL-AWS-ADMINS-BASELINE 4-TPL-AWS-GWLB-LRE-OVRLY ]
Cluster Enabled: no
==========================================================================
Template Stack: CLD-STK-AWS-COMBINED-AZ-A
Templates : [ CLD-4-TPL-AWS-GWLB-OVRLY-COMBINED CLD-2-TPL-AWS-GLOBAL-COMMON-BASELINE CLD-1-TPL-AWS-REGIONAL-USW2 ]
Cluster Enabled: no
Serial Hostname IPv4 IPv6 Connected
--------------------------------------------------------------------------
SERIAL000000014 host-58.example.local 192.0.2.5 unknown no
Wildfire Real-time Stream Disablednot deactivated last template commit all state: commit succeeded with warnings
last template commit all updated: 2026/05/30 14:37:03
last template validate all state: none
last template validate all updated: none
Local configuration size: 11 KB
Merged configuration size(local, panorama pushed, predefined): 18 MB
Predefined configuration size: 19 MB
Maximum recommended merged configuration size: 0 MB (0% configured)
template md5sum: 1544c6a88332abafca06e5a058d2d8ab(In Sync)
template version: 145
template md5sum(no content preview):1544c6a88332abafca06e5a058d2d8ab(In Sync)
template md5sum(old): 1544c6a88332abafca06e5a058d2d8ab(In Sync)
VPN Disable Mode: no
Operational Mode: normal
Certificate Status:
Certificate subject Name:
Certificate expiry at:
Connected at:
Custom certificate Used:
Last masterkey push status: Unknown
Last masterkey push timestamp: none
Express mode: no
Device cellular ports: 0
Device cert present :
Device cert expiry date : N/A
==========================================================================
Template Stack: CLD-STK-AWS-COMBINED-AZ-B
Templates : [ CLD-4-TPL-AWS-GWLB-OVRLY-COMBINED CLD-2-TPL-AWS-GLOBAL-COMMON-BASELINE CLD-1-TPL-AWS-REGIONAL-USW2 ]
Cluster Enabled: no
Serial Hostname IPv4 IPv6 Connected
--------------------------------------------------------------------------
SERIAL000000013 host-59.example.local 192.0.2.4 unknown no
Wildfire Real-time Stream Disablednot deactivated last template commit all state: commit succeeded with warnings
last template commit all updated: 2026/05/30 14:37:02
last template validate all state: none
last template validate all updated: none
Local configuration size: 11 KB
Merged configuration size(local, panorama pushed, predefined): 18 MB
Predefined configuration size: 19 MB
Maximum recommended merged configuration size: 0 MB (0% configured)
template md5sum: 943a0144c8f6eb4c8b42536357340bc7(In Sync)
template version: 145
template md5sum(no content preview):943a0144c8f6eb4c8b42536357340bc7(In Sync)
template md5sum(old): 943a0144c8f6eb4c8b42536357340bc7(In Sync)
VPN Disable Mode: no
Operational Mode: normal
Certificate Status:
Certificate subject Name:
Certificate expiry at:
Connected at:
Custom certificate Used:
Last masterkey push status: Unknown
Last masterkey push timestamp: none
Express mode: no
Device cellular ports: 0
Device cert present :
Device cert expiry date : N/A
==========================================================================
Template Stack: STK-AWS-COMBINED-AZ-C
Templates : [ 1-TPL-AWS-REGIONAL-USW2 2-TPL-AWS-GLOBAL-COMMON-BASELINE 3-TPL-AWS-ADMINS-BASELINE 4-TPL-AWS-GWLB-ARE-OVRLY-COMBINED ]
Cluster Enabled: no
==========================================================================
Template Stack: STK-AWS-ARE-COMBINED-AZ-B
Templates : [ 1-TPL-AWS-REGIONAL-USW2 2-TPL-AWS-GLOBAL-COMMON-BASELINE 3-TPL-AWS-ADMINS-BASELINE 4-TPL-AWS-GWLB-ARE-OVRLY-COMBINED ]
Cluster Enabled: no
==========================================================================
Template Stack: STK-AWS-COMBINED-NON-OVRLY-AZ
Templates : [ 1-TPL-AWS-REGIONAL-USW2 2-TPL-AWS-GLOBAL-COMMON-BASELINE 3-TPL-AWS-ADMINS-BASELINE 4-TPL-AWS-GWLB-NON-OVRLY-COMBINED ]
Cluster Enabled: no
==========================================================================
Template Stack: STK-AWS-COMBINED-AZ-A
Templates : [ 1-TPL-AWS-REGIONAL-USW2 2-TPL-AWS-GLOBAL-COMMON-BASELINE 3-TPL-AWS-ADMINS-BASELINE 4-TPL-AWS-GWLB-OVRLY-CMB-ARE ]
Cluster Enabled: no
==========================================================================
Template Stack: STK-AWS-LRE-COMBINED-AZ-A
Templates : [ 1-TPL-AWS-REGIONAL-USW2 2-TPL-AWS-GLOBAL-COMMON-BASELINE 3-TPL-AWS-ADMINS-BASELINE 4-TPL-AWS-GWLB-LRE-OVRLY ]
Cluster Enabled: no
show templates
Show templates
==========================================================================
Template: USER-ID
Cluster Enabled: no
==========================================================================
TemplateStack: STK-AWS-ARE-COMBINED-AZ-A
Cluster Enabled: no
==========================================================================
Template: 2-TPL-AWS-GLOBAL-COMMON-BASELINE
Cluster Enabled: no
==========================================================================
Template: 4-TPL-AWS-GWLB-LRE-OVRLY
Cluster Enabled: no
==========================================================================
TemplateStack: STK-AWS-ARE-INBOUND
Cluster Enabled: no
==========================================================================
TemplateStack: AWS-GCPS-East2-NetworkStack
Cluster Enabled: no
==========================================================================
Template: 1-TPL-AWS-REGIONAL-USW2
Cluster Enabled: no
==========================================================================
Template: 4-TPL-AWS-GWLB-ARE-OVRLY-COMBINED
Cluster Enabled: no
==========================================================================
TemplateStack: CLD-STK-AWS-COMBINED-AZ-A
Cluster Enabled: no
Serial Hostname IPv4 IPv6 Connected
--------------------------------------------------------------------------
SERIAL000000014 host-58.example.local 192.0.2.5 unknown no
Wildfire Real-time Stream Disablednot deactivated last template commit all state: commit succeeded with warnings
last template commit all updated: 2026/05/30 14:37:03
last template validate all state: none
last template validate all updated: none
Local configuration size: 11 KB
Merged configuration size(local, panorama pushed, predefined): 18 MB
Predefined configuration size: 19 MB
Maximum recommended merged configuration size: 0 MB (0% configured)
template md5sum: 1544c6a88332abafca06e5a058d2d8ab(In Sync)
template version: 145
template md5sum(no content preview):1544c6a88332abafca06e5a058d2d8ab(In Sync)
template md5sum(old): 1544c6a88332abafca06e5a058d2d8ab(In Sync)
VPN Disable Mode: no
Operational Mode: normal
Certificate Status:
Certificate subject Name:
Certificate expiry at:
Connected at:
Custom certificate Used:
Last masterkey push status: Unknown
Last masterkey push timestamp: none
Express mode: no
Device cellular ports: 0
Device cert present :
Device cert expiry date : N/A
==========================================================================
TemplateStack: CLD-STK-AWS-COMBINED-AZ-B
Cluster Enabled: no
Serial Hostname IPv4 IPv6 Connected
--------------------------------------------------------------------------
SERIAL000000013 host-59.example.local 192.0.2.4 unknown no
Wildfire Real-time Stream Disablednot deactivated last template commit all state: commit succeeded with warnings
last template commit all updated: 2026/05/30 14:37:02
last template validate all state: none
last template validate all updated: none
Local configuration size: 11 KB
Merged configuration size(local, panorama pushed, predefined): 18 MB
Predefined configuration size: 19 MB
Maximum recommended merged configuration size: 0 MB (0% configured)
template md5sum: 943a0144c8f6eb4c8b42536357340bc7(In Sync)
template version: 145
template md5sum(no content preview):943a0144c8f6eb4c8b42536357340bc7(In Sync)
template md5sum(old): 943a0144c8f6eb4c8b42536357340bc7(In Sync)
VPN Disable Mode: no
Operational Mode: normal
Certificate Status:
Certificate subject Name:
Certificate expiry at:
Connected at:
Custom certificate Used:
Last masterkey push status: Unknown
Last masterkey push timestamp: none
Express mode: no
Device cellular ports: 0
Device cert present :
Device cert expiry date : N/A
==========================================================================
TemplateStack: STK-AWS-COMBINED-AZ-C
Cluster Enabled: no
==========================================================================
Template: CLD-2-TPL-AWS-GLOBAL-COMMON-BASELINE
Cluster Enabled: no
==========================================================================
TemplateStack: STK-AWS-ARE-COMBINED-AZ-B
Cluster Enabled: no
==========================================================================
Template: 4-TPL-AWS-GWLB-OVRLY-CMB-ARE
Cluster Enabled: no
==========================================================================
Template: iron-skillet
Cluster Enabled: no
==========================================================================
Template: 4-TPL-AWS-GWLB-NON-OVRLY-COMBINED
Cluster Enabled: no
==========================================================================
TemplateStack: STK-AWS-COMBINED-NON-OVRLY-AZ
Cluster Enabled: no
==========================================================================
Template: 4-TPL-AWS-GWLB-NON-OVRLY-CMB-DIS-ARE
Cluster Enabled: no
==========================================================================
Template: TPL-CERT
Cluster Enabled: no
==========================================================================
Template: CLD-1-TPL-AWS-REGIONAL-USW2
Cluster Enabled: no
==========================================================================
Template: 3-TPL-AWS-ADMINS-BASELINE
Cluster Enabled: no
==========================================================================
TemplateStack: STK-AWS-COMBINED-AZ-A
Cluster Enabled: no
==========================================================================
TemplateStack: STK-AWS-LRE-COMBINED-AZ-A
Cluster Enabled: no
==========================================================================
Template: CLD-4-TPL-AWS-GWLB-OVRLY-COMBINED
Cluster Enabled: no
show threat
Show threat id descriptions
show upgrade-history
Show the software versions installed on the device.
show usage
Collect Panorama specific plugin information
show applications list <value>
| Parameter | Description |
|---|---|
<value> |
name of application-group or application-filter |
show applications list <value>
list of appplication-groups or application-filter names
show auth {radius-require-msg-authentic | remote-host-check | strict-username-check}
show auth radius-require-msg-authentic
radius-require-msg-authentic
show auth remote-host-check
remote-host-check
show auth strict-username-check
strict-username-check
show authentication {allowlist | groupdb | groupnames | locked-users | service-principal | service-principals | statistics}
show authentication allowlist
Show allowlist
show authentication groupdb
Show groupdb
show authentication groupnames
Show groupnames
show authentication locked-users
Show locked users
show authentication service-principal
Show service principal in the keytab of auth profile
show authentication service-principals
Show all service principals in the keytab of auth profile, including their realms
show authentication statistics
Show authentication stat for an admin user from CLI
show cli {idle-timeout | info | permissions}
show cli idle-timeout
Show timeout information for this adminitrative session
show cli info
Show various CLI info
show cli permissions
Show permissions
show cloud-appid {app-objects-in-policy | app-to-filtergroup-mapping | application <value> | connection-to-cloud | ha-info | overlap-appid | version}
| Parameter | Description |
|---|---|
<value> |
application name |
show cloud-appid app-objects-in-policy
Show application-filter/application-groups referred in policy
show cloud-appid app-to-filtergroup-mapping
Show application to matched filter and groups
show cloud-appid application <value>
Show Application info for UI
show cloud-appid connection-to-cloud
Show gRPC connection status to cloud application server
show cloud-appid ha-info
Show statistics of cloud application high availability
show cloud-appid overlap-appid
Show duplicated applications in predefined content
show cloud-appid version
Show Cloud-AppID version
show cloud-appid application-filter {all | option}
show cloud-appid application-filter all
Show cloud apps in all application-filters
show cloud-appid application-filter option
Show cloud apps matching specific filter
show cloud-appid application-group {all | option}
show cloud-appid application-group all
Show cloud apps in all application-groups
show cloud-appid application-group option
Show cloud apps in specific group
show cloud-appid cloud-app-data {app-metadata | application | container}
show cloud-appid signature-dp {app-signature | threat-signature}
| Parameter | Description |
|---|---|
<value> |
check if application is used on dp |
show cloud-appid signature-dp app-container-mapping
show application-to-container mappings
show cloud-appid signature-dp app-sig-mapping
show signatures-to-application mappings
show cloud-appid signature-dp appid <value>
check if application is used on dp
show cloud-appid signature-dp application-dp-all
show all applications used on DP
show cloud-appid signature-dp ignored-cloudapp
Show ignored cloud apps
show cloud-appid signature-dp pending-request
Show pending signature requests on MP
show cloud-appid signature-dp statistics
show signature statistics
show cloud-appid task {all | statistics | task-index <value>}
| Parameter | Description |
|---|---|
<value> |
task index |
show cloud-appid task all
Show all cloud application tasks
show cloud-appid task statistics
statistics of task management
show cloud-appid task task-index <value>
task index
show cloud-appid transaction {all | trans-index <value>}
| Parameter | Description |
|---|---|
<value> |
task index |
show cloud-appid transaction all
Show all transactions
show cloud-appid transaction trans-index <value>
task index
show cloud-userid {config | config-details | statistics}
show cloud-userid config
Show cloud userid config
show cloud-userid config-details
Show cloud userid config details
show cloud-userid statistics
Show cloud user statistics
show cluster-userid statistics
show cluster-userid statistics
Show cluster upload/download statistics
show config {candidate | commit-scope | diff | running | size | synced}
show config candidate
Candidate configuration
show config commit-scope
Commit Scope
show config diff
Diff running and candidate configuration
show config running
Running configuration
show config size
Size
show config synced
Configuration last synchronized with HA peer
show config audit {base-version | base-version-no-deletes | version}
show config audit info
Information
show config list {admins | audit-comments | change-summary | changes}
show config list admins
admins in access domain
show config list audit-comments
Show audit comments
show config list change-summary
show summary of uncommitted changed components
show config list changes
list uncommitted changes
show config push-scope {device-group | template-stack}
| Parameter | Description |
|---|---|
<value> |
Admin who committed the change |
show config push-scope admin <value>
admin
show config repo {file <value> | version <value>}
| Parameter | Description |
|---|---|
<value> |
Filename |
show config repo file <value>
Filename
show config repo version <value>
Version
show config saved {<value> | candidate-config | elasticsearch}
| Parameter | Description |
|---|---|
<value> |
Saved configuration |
show config saved candidate-config
candidate-config claude-aws-pano-base.xml 2026/04/17 12:49:55 188.6K
show config saved elasticsearch
2026/05/30 13:06:42 4.0K running-config.xml 2026/05/30 13:06:46 357.0K
show container
Invalid syntax.show container dp-info {dp}
show counter management-server
show counter management-server
Show management server counter information
show counter interface {all | bond1 | management}
show counter interface all
Show all interface counter information
show counter interface bond1
Show bond1 interface counter information ethernet1/1 Show ethernet1/1 interface counter information ethernet1/2 Show ethernet1/2 interface counter information ethernet1/3 Show ethernet1/3 interface counter information ethernet1/4 Show ethernet1/4 interface counter information ethernet1/5 Show ethernet1/5 interface counter information
show counter interface management
Show management interface counter information
show deployment-update-schedule status
show deployment-update-schedule status
Show deployment update schedule status
show device-certificate {info | status}
show device-certificate info
info
show device-certificate status
status
show device-messages cluster <value>
| Parameter | Description |
|---|---|
<value> |
name of cluster |
show device-messages cluster <value>
name of cluster
show device-messages group {<value> | AWS-GCPS-East2 | CLD-DG-AWS-COMBINED | DG-AWS | DG-AWS-ARE-COMBINED | DG-AWS-ARE-INBOUND | DG-AWS-COMBINED | DG-AWS-LRE-COMBINED}
| Parameter | Description |
|---|---|
<value> |
name of device group |
show device-messages group AWS-GCPS-East2
AWS-GCPS-East2
show device-messages group CLD-DG-AWS-COMBINED
CLD-DG-AWS-COMBINED
show device-messages group DG-AWS
DG-AWS
show device-messages group DG-AWS-ARE-COMBINED
DG-AWS-ARE-COMBINED
show device-messages group DG-AWS-ARE-INBOUND
DG-AWS-ARE-INBOUND
show device-messages group DG-AWS-COMBINED
DG-AWS-COMBINED
show device-messages group DG-AWS-LRE-COMBINED
DG-AWS-LRE-COMBINED
show device-messages template {1-TPL-AWS-REGIONAL-USW2 | 2-TPL-AWS-GLOBAL-COMMON-BASELINE | 3-TPL-AWS-ADMINS-BASELINE | 4-TPL-AWS-GWLB-ARE-OVRLY-COMBINED | 4-TPL-AWS-GWLB-LRE-OVRLY | 4-TPL-AWS-GWLB-NON-OVRLY-CMB-DIS-ARE | 4-TPL-AWS-GWLB-NON-OVRLY-COMBINED | 4-TPL-AWS-GWLB-OVRLY-CMB-ARE | <value> | AWS-GCPS-East2-NetworkStack | CLD-1-TPL-AWS-REGIONAL-USW2 | CLD-2-TPL-AWS-GLOBAL-COMMON-BASELINE | CLD-4-TPL-AWS-GWLB-OVRLY-COMBINED | CLD-STK-AWS-COMBINED-AZ-A | CLD-STK-AWS-COMBINED-AZ-B | STK-AWS-ARE-COMBINED-AZ-A | STK-AWS-ARE-COMBINED-AZ-B | STK-AWS-ARE-INBOUND | STK-AWS-COMBINED-AZ-A | STK-AWS-COMBINED-AZ-C | STK-AWS-COMBINED-NON-OVRLY-AZ | STK-AWS-LRE-COMBINED-AZ-A | TPL-CERT | USER-ID | iron-skillet}
| Parameter | Description |
|---|---|
<value> |
name of template |
show device-messages template 1-TPL-AWS-REGIONAL-USW2
1-TPL-AWS-REGIONAL-USW2
show device-messages template 2-TPL-AWS-GLOBAL-COMMON-BASELINE
2-TPL-AWS-GLOBAL-COMMON-BASELINE
show device-messages template 3-TPL-AWS-ADMINS-BASELINE
3-TPL-AWS-ADMINS-BASELINE
show device-messages template 4-TPL-AWS-GWLB-ARE-OVRLY-COMBINED
4-TPL-AWS-GWLB-ARE-OVRLY-COMBINED
show device-messages template 4-TPL-AWS-GWLB-LRE-OVRLY
4-TPL-AWS-GWLB-LRE-OVRLY
show device-messages template 4-TPL-AWS-GWLB-NON-OVRLY-CMB-DIS-ARE
4-TPL-AWS-GWLB-NON-OVRLY-CMB-DIS-ARE
show device-messages template 4-TPL-AWS-GWLB-NON-OVRLY-COMBINED
4-TPL-AWS-GWLB-NON-OVRLY-COMBINED
show device-messages template 4-TPL-AWS-GWLB-OVRLY-CMB-ARE
4-TPL-AWS-GWLB-OVRLY-CMB-ARE
show device-messages template AWS-GCPS-East2-NetworkStack
AWS-GCPS-East2-NetworkStack
show device-messages template CLD-1-TPL-AWS-REGIONAL-USW2
CLD-1-TPL-AWS-REGIONAL-USW2
show device-messages template CLD-2-TPL-AWS-GLOBAL-COMMON-BASELINE
CLD-2-TPL-AWS-GLOBAL-COMMON-BASELINE
show device-messages template CLD-4-TPL-AWS-GWLB-OVRLY-COMBINED
CLD-4-TPL-AWS-GWLB-OVRLY-COMBINED
show device-messages template CLD-STK-AWS-COMBINED-AZ-A
CLD-STK-AWS-COMBINED-AZ-A
show device-messages template CLD-STK-AWS-COMBINED-AZ-B
CLD-STK-AWS-COMBINED-AZ-B
show device-messages template STK-AWS-ARE-COMBINED-AZ-A
STK-AWS-ARE-COMBINED-AZ-A
show device-messages template STK-AWS-ARE-COMBINED-AZ-B
STK-AWS-ARE-COMBINED-AZ-B
show device-messages template STK-AWS-ARE-INBOUND
STK-AWS-ARE-INBOUND
show device-messages template STK-AWS-COMBINED-AZ-A
STK-AWS-COMBINED-AZ-A
show device-messages template STK-AWS-COMBINED-AZ-C
STK-AWS-COMBINED-AZ-C
show device-messages template STK-AWS-COMBINED-NON-OVRLY-AZ
STK-AWS-COMBINED-NON-OVRLY-AZ
show device-messages template STK-AWS-LRE-COMBINED-AZ-A
STK-AWS-LRE-COMBINED-AZ-A
show device-messages template TPL-CERT
TPL-CERT
show device-messages template USER-ID
USER-ID
show device-messages template iron-skillet
iron-skillet
show device-telemetry {all-template-stacks | collect-now | details | region-list | settings | stats | template-stack}
show device-telemetry all-template-stacks
Show device telemetry settings of all template stacks
show device-telemetry collect-now
Show device telemetry collect-now status
show device-telemetry details
Show device telemetry details
show device-telemetry region-list
Show device telemetry region-list
show device-telemetry settings
Show device telemetry settings
show device-telemetry stats
Show device telemetry stats
show device-telemetry template-stack
Show device telemetry setting of a template stack
show devices {all | connected}
show devices all
All managed devices
show devices connected
All connected devices
show dlsrvr {distribute | poll-interval | server}
show dlsrvr distribute
Show the Deployment across HA setting
show dlsrvr poll-interval
Show the polling interval of download jobs (in seconds)
show dlsrvr server
Show the overridden server address used for deployment
show high-availability {all | path-monitoring | state | transitions}
show high-availability all
Show high-availability information
show high-availability path-monitoring
Show path-monitoring statistics
show high-availability state
Show high-availability state information
show high-availability transitions
Show high-availability transition statistic information
show high-availability control-link statistics
show high-availability control-link statistics
Show control-link statistics
show hsm {client-address | client-version | client-version-list | ha-status | info | nshield-connect-rfs | servers | slots | state}
show hsm client-address
Show HSM client ip address.
show hsm client-version
Show HSM LUNASA client version
show hsm client-version-list
Show available LUNASA client version
show hsm ha-status
Show HSM HA setting and members. Only valid for Luna SA
show hsm info
Show HSM info
show hsm nshield-connect-rfs
Show nshield-connect RFS info. Only valid for nshield connect
show hsm servers
Show HSM registered servers
show hsm slots
Show HSM slots
show hsm state
Show HSM connection state
show inter-log-collector detail
show inter-log-collector detail
inter log collector details
show interface {all | bond1 | management}
show interface all
Show all interface information
show interface bond1
Show bond1 interface information ethernet1/1 Show ethernet1/1 interface information ethernet1/2 Show ethernet1/2 interface information ethernet1/3 Show ethernet1/3 interface information ethernet1/4 Show ethernet1/4 interface information ethernet1/5 Show ethernet1/5 interface information
show interface management
Show management interface information
show iot
Invalid syntax.show iot device-inventory {all | any | summmary}
show iot device-inventory all
Show devices inventory
show iot device-inventory any
Show devices inventorymatching any of the values
show iot device-inventory summmary
Show device inventory summary
show iot edit-device-inventory {id <value> | jobs}
| Parameter | Description |
|---|---|
<value> |
<1-4294967295> By id |
show iot edit-device-inventory id <value>
By id
show iot edit-device-inventory jobs
All jobs
show iot export-device-inventory {all | any}
show iot export-device-inventory all
Show devices inventory
show iot export-device-inventory any
Show devices inventorymatching any of the values
show iot host-cache {all | hostid <value>}
| Parameter | Description |
|---|---|
<value> |
hostid of a device |
show iot host-cache all
Show all devices
show iot host-cache hostid <value>
hostid of a device
show iot icd {statistics}
show iot icd version
Show ICD version
show iot ip-device-mapping-mp {all | ip <ip/netmask>}
| Parameter | Description |
|---|---|
<ip/netmask> |
<ip/netmask> |
show iot ip-device-mapping-mp all
Show all devices
show iot ip-device-mapping-mp ip <ip/netmask>
Show device info for IP address
show jobs {all | id <value> | pending | processed}
| Parameter | Description |
|---|---|
<value> |
<1-4294967295> By id |
show jobs all
All jobs
show jobs id <value>
By id
show jobs pending
Pending jobs
show jobs processed
Completed/active jobs
show lc-query id <value>
| Parameter | Description |
|---|---|
<value> |
<1-4294967295> |
show lc-query id <value>
id
show location ip <ip>
| Parameter | Description |
|---|---|
<ip> |
<ip> |
show location ip <ip>
By IP address
show log {appstat | auth | config | corr | corr-categ | corr-detail | dailydesum | dailygtpsum | dailysctpsum | dailythsum | dailytrsum | dailyurlsum | data | decryption | desum | globalprotect | gtp | gtpsum | hipmatch | hourlydesum | hourlygtpsum | hourlysctpsum | hourlythsum | hourlytrsum | hourlyurlsum | iptag | mdm | sctp | sctpsum | system | threat | thsum | trace | traffic | trsum | tunnel | url | urlsum | userid | weeklydesum | weeklygtpsum | weeklysctpsum | weeklythsum | weeklytrsum | weeklyurlsum | wildfire}
show log appstat
Show appstat logs
show log auth
Show authentication logs
show log config
Show config logs
show log corr
Show correlation object event logs
show log corr-categ
Show correlation event category logs
show log corr-detail
Show correlation event detailed information
show log dailydesum
Show dailydesum logs
show log dailygtpsum
Show daily tunnel and gtp summary logs
show log dailysctpsum
Show daily sctp summary logs
show log dailythsum
Show dailythsum logs
show log dailytrsum
Show dailytrsum logs
show log dailyurlsum
Show dailyurlsum logs
show log data
Show data logs
show log decryption
Show decryption logs
show log desum
Show desum logs
show log globalprotect
Show globalprotect logs
show log gtp
Show GTP logs
show log gtpsum
Show tunnel and gtp summary logs
show log hipmatch
Show hipmatch logs
show log hourlydesum
Show hourlydesum logs
show log hourlygtpsum
Show hourly tunnel and gtp summary logs
show log hourlysctpsum
Show hourly sctp summary logs
show log hourlythsum
Show hourlythsum logs
show log hourlytrsum
Show hourlytrsum logs
show log hourlyurlsum
Show hourlyurlsum logs
show log iptag
Show iptag logs
show log mdm
Show mdm logs
show log sctp
Show SCTP logs
show log sctpsum
Show sctp summary logs
show log system
Show system logs
show log threat
Show threat logs
show log thsum
Show thsum logs
show log trace
Show trace logs
show log traffic
Show traffic logs
show log trsum
Show trsum logs
show log tunnel
Show Tunnel logs
show log url
Show url logs
show log urlsum
Show urlsum logs
show log userid
Show User-ID logs
show log weeklydesum
Show weeklydesum logs
show log weeklygtpsum
Show weekly tunnel and gtp summary logs
show log weeklysctpsum
Show weekly sctp summary logs
show log weeklythsum
Show weeklythsum logs
show log weeklytrsum
Show weeklytrsum logs
show log weeklyurlsum
Show weeklyurlsum logs
show log wildfire
Show wildfire logs
show log-collector {<value> | all | connected}
show log-collector all
All managed log_collectors
show log-collector connected
All connected log_collectors
show log-collector serial-number {<serial> | <value>}
| Parameter | Description |
|---|---|
<value> |
log collector name |
show log-collector-es-cluster health
show log-collector-es-cluster health
Show elastic search cluster health
show log-collector-es-cluster state {blocks | master_node | meta_data | nodes | routing_table | version}
show log-collector-es-cluster state blocks
Show elastic search cluster state blocks
show log-collector-es-cluster state master_node
Show elastic search cluster state master_node
show log-collector-es-cluster state meta_data
Show elastic search cluster state routing_table
show log-collector-es-cluster state nodes
Show elastic search cluster state nodes
show log-collector-es-cluster state routing_table
Show elastic search cluster state routing_table
show log-collector-es-cluster state version
Show elastic search cluster state version
show log-collector-group {<value> | all | from}
show log-collector-group all
All managed log_collector_groups
show log-collector-group from
from
show log-collector-group name {<value> | default}
| Parameter | Description |
|---|---|
<value> |
log collector group name |
show log-collector-group name default
default
show logging-status {all | device <value>}
| Parameter | Description |
|---|---|
<value> |
Device serial no |
show logging-status all
All connected devices
show logging-status device <value>
Device serial no
show management-server disable-tls1-0-status
show management-server disable-tls1-0-status
Check if the TLSv1.0 is disabled for management server(Default: SSL TLSv1.0 negotiation is allowed)
show management-tunnel {certificates | list-conns | list-sas}
show management-tunnel certificates
certificates
show management-tunnel list-conns
Show loaded connection information
show management-tunnel list-sas
Show active tunnel IKE_SAs information
show monitoring {health | units}
show monitoring health
health
show monitoring units
units
show monitoring info {cluster | dp-heatmap | dp-status | environmentals | events | high-availability | interface | interfaces | logging-external | trend}
show monitoring info cluster
Show device cluster stats
show monitoring info dp-heatmap
Show dp heatmap for the device
show monitoring info dp-status
Show time trended information for dp specific things
show monitoring info environmentals
Show environmental information
show monitoring info events
Show events for a device
show monitoring info high-availability
Show device high availability stats
show monitoring info interface
Show time trended information for device interface
show monitoring info interfaces
Show device interfaces
show monitoring info logging-external
Show device logging connections and external logging
show monitoring info trend
Show time trended information for device
show monitoring sdwan-info link
show monitoring sdwan-info link
Show time trended information for a given link
show object static
show object static
Static IP to object name
show object dynamic-address-group {all | name <value>}
| Parameter | Description |
|---|---|
<value> |
Show dynamic address group by name |
show object dynamic-address-group all
Show all dynamic address groups
show object dynamic-address-group name <value>
Show dynamic address group by name
show object registered-ip {tag}
| Parameter | Description |
|---|---|
<ip/netmask> |
<ip/netmask> |
<ip-range> |
<ip1-ip2> |
show object registered-ip all
Display all registered addresses
show object registered-ip ip <ip/netmask>
Display registered address matches given IP
show object registered-ip iprange <ip-range>
Display registered address matches given IP-Range
show object registered-user {tag | user}
show object registered-user all
Display all registered users
show plugins {dependencies | devicegroups | installed | packages | users}
show plugins dependencies
show plugin dependencies
show plugins devicegroups
Show device groups
show plugins installed
installed
show plugins packages
packages
show plugins users
users
show plugins aws {cloud-ngfw | counters}
show plugins aws cloud-monitoring-definition <name>
cloud-monitoring-definition
show plugins aws cngfw-device-groups
Show cloudngfw device groups.
show plugins aws cngfw-device-groups-association
Show cloudngfw device groups.
show plugins aws cngfw-regions
Show cloudngfw regions.
show plugins aws cngfw-resources
Show resource associated with a cloudngfw region/tenant.
show plugins aws cngfw-status
Show cloud ngfw status by trying to connect to server and performing license check.
show plugins aws cngfw-template-stacks
Show cloudngfw template stacks.
show plugins aws cngfw-tenant-dg-mapping
Show cloudngfw tenant to dg mapping.
show plugins aws cngfw-tenants
Show cloudngfw tenants.
show plugins aws deployment <value>
VM-Series deployment configuration
show plugins aws deployment-status
Show status of deployments
show plugins aws detailed-deployment-status
Show detailed status of deployment
show plugins aws detailed-iam-role-status
Show detailed status of each iam roles
show plugins aws details-dashboard
Show details for monitoring-definition
show plugins aws eks-service-account <name>
Configure EKS Clusters for monitoring
show plugins aws eks-status
show status of EKS clusters
show plugins aws iam-role <value>
IAM Role information for AWS
show plugins aws iam-role-status
Show status of iam roles validity
show plugins aws ip-details
show tags associated to ip address
show plugins aws monitoring-definition <value>
AWS monitoring for VM-Series
show plugins aws notify-group <name>
notify-group | Pipe through a command
show plugins aws object-name-mapping
Show mapping of Panorama Objects to services/cluster
show plugins aws port-map
Show EKS services port mapping
show plugins aws region-filter
show tags associated to ip address
show plugins aws tag-details
show IP address associated to tag
show plugins aws usage
Show telemetry of AWS plugin
show plugins aws vm-mon-status
show status of monitoring definitions
show plugins aws vpc-filter
show tags associated to ip address
show plugins cloudconnector {cloud-dg | regions | resources | setup | status | tenant-dg-mapping | tenants}
show plugins cloudconnector cloud-dg
Setup cloud-ngfw device-group
show plugins cloudconnector regions
Show cloudngfw regions.
show plugins cloudconnector resources
Show resource associated with a cloudngfw region/tenant.
show plugins cloudconnector setup
Setup | Pipe through a command
show plugins cloudconnector status
Show status by trying to connect to server and performing license check.
show plugins cloudconnector tenant-dg-mapping
Show cloudngfw tenant to dg mapping.
show plugins cloudconnector tenants
Show cloudngfw tenants.
show plugins openconfig {bridge | bundling | connections | info | model-stats | streaming_telemetry | subscriptions | subscriptions-detail}
show plugins sw_fw_license {devices | offline-license | panorama-api-requests}
show policy-recommendation {iot | saas}
show policy-recommendation iot
Show IoT policy recommendation
show policy-recommendation saas
Show SAAS policy recommendation
show predefined {certificate | default-security-rules | ssl-tls-service-profile}
show predefined certificate
certificate
show predefined default-security-rules
default-security-rules
show predefined ssl-tls-service-profile
ssl-tls-service-profile
show push-schedule status
show push-schedule status
Show push schedule status
show query {jobid <value> | jobs | result | stats}
| Parameter | Description |
|---|---|
<value> |
<1-4294967295> Distributed query states across CGs |
show query jobid <value>
Distributed query states across CGs
show query jobs
All jobs
show query result
All jobs
show query stats
Get Query stats
show query effective-queries logtypes <value>
| Parameter | Description |
|---|---|
<value> |
member value |
show query effective-queries logtypes <value>
logtypes | Pipe through a command
show redistribution
Invalid syntax.show redistribution agent {state}
show redistribution agent statistics
Show redistribution-agent statistics
show redistribution service {client}
show redistribution service status
Show redistribution service status
show report {activity-timeline | directory-listing | distributed-states | id <value> | jobs}
| Parameter | Description |
|---|---|
<value> |
<1-4294967295> By id |
show report activity-timeline
activity-timeline
show report directory-listing
directory-listing
show report distributed-states
distributed-states
show report id <value>
By id
show report jobs
All jobs
show report cache {cache_id <value> | info}
| Parameter | Description |
|---|---|
<value> |
<1-4294967295> By cache entry id |
show report cache cache_id <value>
By cache entry id
show report cache info
info
show report exec_mgr {batch_id <value> | info}
| Parameter | Description |
|---|---|
<value> |
<1-4294967295> By batch id |
show report exec_mgr batch_id <value>
By batch id
show report exec_mgr info
info
show rule-hit-count
Invalid syntax.show rule-hit-count device-group {AWS-GCPS-East2 | CLD-DG-AWS-COMBINED | DG-AWS | DG-AWS-ARE-COMBINED | DG-AWS-ARE-INBOUND | DG-AWS-COMBINED | DG-AWS-LRE-COMBINED}
| Parameter | Description |
|---|---|
<value> |
device-group name |
show sp-metadata management
show sp-metadata management
Admin WebUI SAML sp metadata
show ssl-conn-on-cert {fail-all-conns | fail-syslog-conns}
show ssl-conn-on-cert fail-all-conns
Fail all ssl connections
show ssl-conn-on-cert fail-syslog-conns
Fail syslog connections
show streaming-telemetry region-list
show streaming-telemetry region-list
Show device telemetry regions
show system {disk-partition | disk-space | files | info | last-commit-info | logdb-quota | masterkey-properties | pancfg-directory-usage | resources | search-engine-quota}
show system disk-partition
Show disk partion information
show system disk-space
Report filesystem disk space usage
show system files
List important files in the system
show system info
System information
show system last-commit-info
System last commit detail information
show system logdb-quota
Report logbd quotas
show system masterkey-properties
Master key properties
show system pancfg-directory-usage
List directory usage in the pancfg partition with max-depth three
show system resources
System resources
show system search-engine-quota
Report search engine quotas
show system disk details
show system disk details
Get detailed disks status
show system nfs {dynamic-logging-partition}
show system setting {mp-memory-monitor | rule-hit-count | target | url-database}
show system setting mp-memory-monitor
Show monitoring of management memory
show system setting rule-hit-count
Rule hit count feature enabled or disabled
show system setting target
target device group or template
show system setting url-database
URL database
show system software status
show system software status
Status information
show system state {browser | filter <value> | filter-pretty <value>}
| Parameter | Description |
|---|---|
<value> |
Filter by subtree/wildcard |
show system state browser
Navigate in a text-mode browser
show system state filter <value>
Filter by subtree/wildcard
show system state filter-pretty <value>
Filter by subtree/wildcard w/ pretty printing | Pipe through a command
show user {email-lookup | hip-report | user-attributes}
show user email-lookup
Lookup user-id user for given email addresses
show user hip-report
Show HIP report
show user user-attributes
Show users and all attributes
show user cloud-identity-engine {statistics | status}
show user cloud-identity-engine client
Show cloud identity engine client
show user credential-filter {group-mapping | statistics}
show user credential-filter group-mapping
Show Group-Mapping usernames and profile IDs for a vsys
show user credential-filter statistics
Show credential enforcement filter statistics
show user device-groups {state}
show user group {list | name <value>}
| Parameter | Description |
|---|---|
<value> |
Show group's members |
show user group list
List All groups
show user group name <value>
Show group's members
show user ip-user-mapping-mp {all | ip <ip/netmask>}
| Parameter | Description |
|---|---|
<ip/netmask> |
<ip/netmask> |
show user ip-user-mapping-mp all
Show all user/groups
show user ip-user-mapping-mp ip <ip/netmask>
Show user/group info for IP address
show user ldap-device-serialno {serialno}
show user ldap-device-serialno all
Show all devices in ldap device serial number database
show user user-id-agent {config | state}
show user user-id-agent statistics
Show user-id-agent statistics
show user user-id-service {client}
show user user-id-service ipuser-update-list
Show user-id service IP user update list
show user user-id-service status
Show user-id service status
show user user-ids {all | match-user <value>}
| Parameter | Description |
|---|---|
<value> |
Show only the user(s) that match the string |
show user user-ids all
Show all user/groups
show user user-ids match-user <value>
Show only the user(s) that match the string
show user xml-api multiusersystem
show user xml-api multiusersystem
Show multiusersytem statistics
show virt nsx {address-group | steering-rule | steering-section}
show virt nsx address-group
Get security groups for address groups
show virt nsx steering-rule
Get steering rules for security policies
show virt nsx steering-section
Get NSX steering sections
show wildfire-appliance {<value> | all | connected | devices-reporting-data | info | last-device-registration | statistics | vm-images}
show wildfire-appliance all
All managed wildfire appliances
show wildfire-appliance connected
All connected wildfire appliances
show wildfire-appliance devices-reporting-data
Show list of devices reporting data to this appliance
show wildfire-appliance info
wildfire appliance info
show wildfire-appliance last-device-registration
Show list of latest registration activities
show wildfire-appliance statistics
wildfire appliance statistics
show wildfire-appliance vm-images
vm-images
show wildfire-appliance-cluster {<value> | all | devices-reporting-data | info | last-device-registration | statistics}
show wildfire-appliance-cluster all
All managed wildfire appliance clusters
show wildfire-appliance-cluster devices-reporting-data
Show list of firewalls reporting data to appliances in this cluster
show wildfire-appliance-cluster info
wildfire appliance cluster info
show wildfire-appliance-cluster last-device-registration
Show list of firewalls registered to appliances in the cluster
show wildfire-appliance-cluster statistics
wildfire appliance cluster statistics
ssh
tail {db-log | es-1-log | es-2-log | es-log | mp-log | plugins-log | webserver-log}
tail db-log
db-log
tail es-1-log
es-1-log
tail es-2-log
es-2-log
tail es-log
es-log
tail mp-log
mp-log
tail plugins-log
plugins-log
tail webserver-log
webserver-log
tcpdump
test {authentication | custom-signature-perf | custom-signature-type | http-profile | http-server | nptv6 | smtp-server | threat-vault}
test authentication
Test User authentication
test custom-signature-perf
Test lscan signature
test custom-signature-type
Test custom signature type
test http-profile
Test Http profile connection
test http-server
Test Http server connection
test nptv6
NPTv6 related commands
test smtp-server
Test smtp server connection
test threat-vault
Test threat-vault connection
test data-filtering {ccn <value> | pattern <value> | ssn <value>}
| Parameter | Description |
|---|---|
<value> |
test credit card number |
test data-filtering ccn <value>
test credit card number
test data-filtering pattern <value>
pattern
test data-filtering ssn <value>
test social security number
test deployment-update-schedule refresh
test deployment-update-schedule refresh
refresh
test generate-saml-url management
test generate-saml-url management
Admin WebUI SAML client
test nfs dynamic-logging-partition
test nfs dynamic-logging-partition
test dynamic logging partition
test scp-server-connection {confirm | initiate}
test scp-server-connection confirm
confirm
test scp-server-connection initiate
initiate
test user-id custom-group
test user-id custom-group
Test User Id Custom Group
tftp
tftp export {application-block-page | captive-portal-text | config-bundle | configuration | debug-pcap | device-state | dnsproxy | file-block-continue-page | file-block-page | global-protect-portal-custom-help-page | global-protect-portal-custom-home-page | global-protect-portal-custom-login-page | global-protect-portal-custom-welcome-page | high-availability-key | inbound-proxy-key | license-token-file | mfa-login-page | mgmt-pcap | ssl-cert-status-page | ssl-optout-text | stats-dump | tech-support | telemetry-data | threat-pcap | url-block-page | url-coach-text | url-isolate-page | virus-block-page | web-interface-certificate}
tftp export application-block-page
Use tftp to export application block comfort page
tftp export captive-portal-text
Use tftp to export captive portal text
tftp export config-bundle
Use tftp to export configuration bundle
tftp export configuration
Use tftp to export configuration
tftp export debug-pcap
Use tftp to export packet capture generated for purpose of debugging daemons
tftp export device-state
Use tftp to export device state
tftp export dnsproxy
Use tftp to export dnsproxy file
tftp export file-block-continue-page
Use tftp to export file block continue comfort page
tftp export file-block-page
Use tftp to export file block comfort page
tftp export global-protect-portal-custom-help-page
Use tftp to export global protect help page
tftp export global-protect-portal-custom-home-page
Use tftp to export GlobalProtect portal custom home page
tftp export global-protect-portal-custom-login-page
Use tftp to export global protect login page
tftp export global-protect-portal-custom-welcome-page
Use tftp to export global protect welcome page
tftp export high-availability-key
Use tftp to export high-availability peer encryption key
tftp export inbound-proxy-key
Use tftp to export inbound proxy key
tftp export license-token-file
Use tftp to export deactivate license token file
tftp export mfa-login-page
Use tftp to export MFA login page
tftp export mgmt-pcap
Use tftp to export packet capture from management interface
tftp export ssl-cert-status-page
Use tftp to export ssl cert revoked notify page
tftp export ssl-optout-text
Use tftp to export ssl optout text
tftp export stats-dump
Use scp to export AVR report data (default is last 7 days)
tftp export tech-support
Use tftp to export tech support info
tftp export telemetry-data
Use tftp to export sent telemetry data
tftp export threat-pcap
Use tftp to export threat packet capture
tftp export url-block-page
Use tftp to export url block comfort page
tftp export url-coach-text
Use tftp to export url coach text
tftp export url-isolate-page
Use tftp to export url isolate page
tftp export virus-block-page
Use tftp to export virus block comfort page
tftp export web-interface-certificate
Use tftp to export web-interface-certificate
tftp export core-file {control-plane | large-corefile}
tftp export core-file control-plane
Use tftp to export control-plane core-file
tftp export core-file large-corefile
Use tftp to export large core files in logdb
tftp export log-file management-plane
tftp export log-file management-plane
Use tftp to export management-plane log-file
tftp import {application-block-page | captive-portal-text | certificate | configuration | credential-block-page | credential-coach-text | data-filter-block-page | file-block-continue-page | file-block-page | global-protect-portal-custom-help-page | global-protect-portal-custom-home-page | global-protect-portal-custom-login-page | global-protect-portal-custom-welcome-page | high-availability-key | keypair | license | mfa-login-page | private-key | safe-search-block-page | software | ssl-cert-status-page | ssl-optout-text | url-block-page | url-coach-text | url-isolate-page | virus-block-page}
tftp import application-block-page
Use tftp to import application block comfort page
tftp import captive-portal-text
Use tftp to import captive portal text
tftp import certificate
Use tftp to import X.509 certificate
tftp import configuration
Use tftp to import configuration
tftp import credential-block-page
Use tftp to import credential enforcement block comfort page
tftp import credential-coach-text
Use tftp to import credential enforcement coach text
tftp import data-filter-block-page
Use tftp to import data filter block comfort page
tftp import file-block-continue-page
Use tftp to import file block continue comfort page
tftp import file-block-page
Use tftp to import file block comfort page
tftp import global-protect-portal-custom-help-page
Use tftp to import GlobalProtect portal custom help page
tftp import global-protect-portal-custom-home-page
Use tftp to import GlobalProtect portal custom home page
tftp import global-protect-portal-custom-login-page
Use tftp to import GlobalProtect portal custom login page
tftp import global-protect-portal-custom-welcome-page
Use tftp to import GlobalProtect portal custom welcome page
tftp import high-availability-key
Use tftp to import high-availability peer encryption key
tftp import keypair
Use tftp to import X.509 key
tftp import license
Use tftp to import license file
tftp import mfa-login-page
Use tftp to import MFA login page
tftp import private-key
Use tftp to import ssl private key
tftp import safe-search-block-page
Use tftp to import safe search block comfort page
tftp import software
Use tftp to import software package
tftp import ssl-cert-status-page
Use tftp to import ssl cert revoked notify page
tftp import ssl-optout-text
Use tftp to import ssl optout text
tftp import url-block-page
Use tftp to import url block comfort page
tftp import url-coach-text
Use tftp to import url coach text
tftp import url-isolate-page
Use tftp to import url isolate page
tftp import virus-block-page
Use tftp to import virus block comfort page
traceroute
view-pcap {mgmt-pcap | threat}
view-pcap mgmt-pcap
packet capture generated from management interface
view-pcap threat
pcap id