Manual export

Export a PAN-OS firewall by hand

Upload the effective configuration and identify the firewall by serial.

On this page

Choose the export
Standalone firewall
Firewall managed by Panorama
Add the serial with show system info
Several virtual systems
What the upload is read for
Through the Relay
Upload
Operational CLI commands

Choose the export

Export	Includes what Panorama pushed	Where
Device state (`.tgz`)	Yes	Device > Setup > Operations > Export device state. Upload the archive as it is.
`show config merged` transcript	Yes	CLI, below.
Named configuration snapshot or `show config running`	No, local configuration only	Accepted, but on a managed firewall the two above are complete.

Standalone firewall

PAN-OS CLI

set cli pager off
set cli config-output-format xml
show config running

Firewall managed by Panorama

PAN-OS CLI

set cli pager off
set cli config-output-format xml
show config merged

Save the session output as one .txt file. Keep the show config merged line directly above the XML: it tells ConfigProof the file is the merged configuration.
Text before and after the XML is allowed up to 64 KiB on each side, and it must be plain text. Any < outside the configuration refuses the file.
Do not run set cli op-command-xml-output on in the same session log. Its XML output around the configuration refuses the file.

Add the serial with show system info

A device state archive or a configuration export carries no serial, and its version has no hotfix. Run this, and after the upload is parsed paste its output in Verify device identity (optional), or in Paste show system info when the page asks for the model.

PAN-OS CLI

show system info

Only hostname, serial, model, software version, family and management address are read. The hostname must match the uploaded file. The CLI text and the XML API answer are both accepted.

Several virtual systems

An export with more than one vsys opens a picker. Each vsys is its own analysis, and the box facts (hardware, interfaces, management, HA) read the same on each.

What the upload is read for

The configuration: policies, NAT, objects, interfaces, management settings and the HA configuration.
With device state or show config merged: the device group policy and template settings Panorama pushed.
From the pasted show system info: serial, model and the full software version.

Through the Relay

Reading	Command
Serial, model and version	`show system info`
Licenses	`request license info`
Routing table	`show routing route` or `show advanced-routing route`
Rule hit counts (vsys1 security rules)	`show rule-hit-count`, read over the XML API
LLDP neighbors	`show lldp neighbors all`, `show lldp config all`
HA state as the firewall reports it (Relay)	`show high-availability state`

Upload

Open New analysis
Choose File upload and select the file, or choose Paste, paste the output and select Upload and parse.
It is sent at once
One file per upload. ConfigProof reads the vendor and export type from the content, not the file name, then asks the client, project and name. If your role is limited to certain clients, choose the client first.
Answer the picker if asked
A file that holds several VDOMs, contexts, virtual systems or gateways opens a picker. Each one you choose is its own analysis.

Operational CLI commands

Commands target vsys1. Select the firewall and virtual system that enforce the policy. Use the XML API through the Relay to include these counters in the report.

Rule hit counts by rulebase

show rule-hit-count vsys vsys1 rule-base security rules all
show rule-hit-count vsys vsys1 rule-base nat rules all
show rule-hit-count vsys vsys1 rule-base decryption rules all
show rule-hit-count vsys vsys1 rule-base pbf rules all
show rule-hit-count vsys vsys1 rule-base qos rules all
show rule-hit-count vsys vsys1 rule-base dos rules all
show rule-hit-count vsys vsys1 rule-base tunnel-inspect rules all
show rule-hit-count vsys vsys1 rule-base application-override rules all
show rule-hit-count vsys vsys1 rule-base authentication rules all
show rule-hit-count vsys vsys1 rule-base sdwan rules all

NAT, security policy and VPN

show running nat-policy
show running security-policy
show vpn ike-sa
show vpn ipsec-sa

Virtual router

show routing route
show routing protocol bgp peer
show routing protocol ospf neighbor

Advanced Routing Engine

show advanced-routing route
show advanced-routing bgp summary
show advanced-routing ospf neighbor
show advanced-routing ospfv3 neighbor

System, interfaces and high availability

show system info
show interface all
show arp all
show lldp neighbors all
show high-availability state
request license info

Report evidence and rule hit counts

PAN-OS. Available sources across collection methods

security: Relay, API: First hit, Last hit, Counting window available on supported readings.; Relay: First hit, Last hit, Counting window available on supported readings.
nat: Relay, API: First hit, Last hit, Counting window available on supported readings.; Relay: First hit, Last hit, Counting window available on supported readings.
decryption: Relay, API: First hit, Last hit, Counting window available on supported readings.; Relay: First hit, Last hit, Counting window available on supported readings.
pbf: Relay, API: First hit, Last hit, Counting window available on supported readings.; Relay: First hit, Last hit, Counting window available on supported readings.
qos: Relay, API: First hit, Last hit, Counting window available on supported readings.; Relay: First hit, Last hit, Counting window available on supported readings.
dos: Relay, API: First hit, Last hit, Counting window available on supported readings.; Relay: First hit, Last hit, Counting window available on supported readings.
tunnel inspection: Relay, API: First hit, Last hit, Counting window available on supported readings.; Relay: First hit, Last hit, Counting window available on supported readings.
application override: Relay, API: First hit, Last hit, Counting window available on supported readings.; Relay: First hit, Last hit, Counting window available on supported readings.
authentication: Relay, API: First hit, Last hit, Counting window available on supported readings.; Relay: First hit, Last hit, Counting window available on supported readings.
sdwan: Relay, API: First hit, Last hit, Counting window available on supported readings.; Relay: First hit, Last hit, Counting window available on supported readings.

Hit counters without a supported source: network packet broker.

Without a counting window, zero hits cannot prove a rule is unused.

Supported checks: Active routes, Route decisions, HA state, VPN and NAT, Remote access, Lifecycle dates, Recommended release, Change attribution, Configuration history, Reachability, Rule dependencies
Checks not yet supported: CDP / LLDP, Tunnel, BGP and interface state, Pending changes

Open New analysis

It is sent at once

Answer the picker if asked

Related guides