Saturday, October 6, 2018

Palo Alto Useful Commands

Management Interface Packet Capture
GUI packet capture can be used for packet capture of inline data interfaces.
To capture traffic on the management interface use cli tcpdump

tcpdump snpalen 0 filter "host a.b.c.d"
view-pcap mgmt-pcap mgmt.pcap
tftp export mgmt-pcap from mgmt.pcap to  {a.b.c.d}

less mp-log authd.log

Debug dataplane packet-diag clear all
debug dataplane packet-diag clear filter-marked-session all
Debug dataplane packet-diag set filter match destination
Debug dataplane packet-diag set filter on
Debug datapplane packet-diag show setting

Show counter  global filter packet-filter yes delta yes

 30 mins mod 3b

show session all filter source
show session all filter state
show session id {number}   even for aged out sessions

No comments: