Palo Alto Firewall - Packet Capture [2024]

#paloaltofirewall #paloaltonetworks #firewall
In this tutorial you're going to learn how to use the packet capture feature of the Palo Alto Firewall, in case you need to analyze some packets going through the device.
If you have questions, suggestions, or any kind of feedback, please don't hesitate to comment below! I will reply as soon as possible.

[@VeZAAMPsel]

many thanks for showing the "merge" feature of wireshark which I haven't known before. Excellent!

[@zgbsoz]

thanks for the excellent video series. Palo Alto will make videos about security profiles? Like Fortigated ips, web filter, app control, antivirus profiles. Thank you very much in advance

[@netsums]

Hello, thank you for the comment. I cannot tell you which videos Palo Alto is planning to publish. But we will keep in mind your interest for following videos we release. 😊

[@onurcan9129]

Thanks a lot for your valuable video series regarding Palo Alto. Can you please make a video regarding upgrading Palo Alto HA Pair ?

[@netsums]

Thank you for your comment. I will keep this in mind for the next videos! 😊

[@sidhardhakoppolu1319]

Please do video on deep dive on panorama.

[@netsums]

Hi. I am planing a video about Panorama Template Variables that I should release until the end of September, hopefully. Thanks for the suggestion, I will keep it in mind. 😊

[@sridharbvnl2101]

great video plz explain packet flow in PA in a video

[@netsums]

Thank you for the comment. I will keep in mind your suggestion. 😊

[@sridharbvnl2101]

I am mean a separate video explaining packet flow in PA fw

[@sridharbvnl2101]

If u can make PA packet flow video, it can help alot

[@user-ui6et3xp4h]

Great video. Thank you. How to do pcap via cli?

[@netsums]

Hi, thank you. Take a look at this page: fwknowledge.wordpress.com/2013/03/07/palo-alto-packet-capture-cli/

[@hitendram]

where is the cli mode, this is very hectic.

[@netsums]

You need to open an ssh connection to the firewall (using putty for example) in order to access the cli. What part of the video did you think was hectic? Just wondering, so I can pay more attention in the upcoming videos.

[@hitendram]

@@netsums sorry for being rude, but with Cisco ftd i directly put the command for packet capture on firewall on cli mode and get logs immediately. The same with gui takes time. And cli is efficient. I just wanted to know if there is such in palo alto.

[@netsums]

No worries. :) As far as I know, with the Palo Alto you have to download the pcap file (either using the cli or on the GUI) and analyze it with Wireshark, for example. Otherwise you would have to use the traffic monitor on the GUI for live logs.

[@JapaPlayerLoks]

@hitendram can u provide the cli command from Cisco? Thanks

[@hitendram]

@@JapaPlayerLoks Google it.