Export a PAN-OS firewall by hand
Upload the effective configuration and identify the firewall by serial.
On this page
Choose the export
| Export | Includes what Panorama pushed | Where |
|---|---|---|
Device state (.tgz) | Yes | Device > Setup > Operations > Export device state. Upload the archive as it is. |
show config merged transcript | Yes | CLI, below. |
Named configuration snapshot or show config running | No, local configuration only | Accepted, but on a managed firewall the two above are complete. |
Capture the merged configuration
set cli pager off
set cli config-output-format xml
show config merged- Save the session output as one
.txtfile. Keep theshow config mergedline directly above the XML: it tells ConfigProof the file is the merged configuration. - Text before and after the XML is allowed up to 64 KiB on each side, and it must be plain text. Any
<outside the configuration refuses the file. - Do not run
set cli op-command-xml-output onin the same session log. Its XML output around the configuration refuses the file.
Add the serial with show system info
A device state archive or a configuration export carries no serial, and its version has no hotfix. Run this, and after the upload is parsed paste its output in Verify device identity (optional), or in Paste show system info when the page asks for the model.
show system infoOnly hostname, serial, model, software version, family and management address are read. The hostname must match the uploaded file. The CLI text and the XML API answer are both accepted.
Several virtual systems
An export with more than one vsys opens a picker. Each vsys is its own analysis, and the box facts (hardware, interfaces, management, HA) read the same on each.
What the upload is read for
- The configuration: policies, NAT, objects, interfaces, management settings and the HA configuration.
- With device state or
show config merged: the device group policy and template settings Panorama pushed. - From the pasted
show system info: serial, model and the full software version.
Through the Collector or Relay
| Reading | Command |
|---|---|
| Serial, model and version | show system info |
| Licenses | request license info |
| Routing table | show routing route or show advanced-routing route |
| Rule hit counts (vsys1 security rules) | show rule-hit-count, read over the XML API |
| LLDP neighbors | show lldp neighbors all, show lldp config all |
| HA state as the firewall reports it (Relay) | show high-availability state |
Upload
Open New analysis
Choose File upload and select the file, or choose Paste, paste the output and select Upload and parse.
It is sent at once
One file per upload. ConfigProof reads the vendor and export type from the content, not the file name, then asks the client, project and name. If your role is limited to certain clients, choose the client first.
Answer the picker if asked
A file that holds several VDOMs, contexts, virtual systems or gateways opens a picker. Each one you choose is its own analysis.