Palo AltoConfig1,567 downloads

Palo Alto PAN-OS Base / Day-0 Config

Day-zero configuration for Palo Alto Networks firewalls: hostname, management interface, DNS, NTP, admin users, and basic system settings via CLI set commands.

↓ example.txt

What is it?

A Palo Alto Networks firewall Day-0 configuration sets the foundational identity and management settings before the device is connected to the network. Unlike Cisco IOS, PAN-OS is primarily configured via the web-based GUI (Panorama or the local WebUI) or via 'set' CLI commands in configuration mode. The base config covers: management IP (for out-of-band access), DNS, NTP, admin credentials, syslog forwarding, and optionally Panorama registration for centralized management. PAN-OS uses a candidate/running config model — changes are staged and then 'committed' to take effect.

When to use

·First time connecting a new Palo Alto firewall (PA-220, PA-400, PA-800, PA-3200, PA-5200 series)
·After a factory reset or RMA device replacement
·Before registering the device with Panorama for centralized management
·As part of a new site deployment or data center build-out

When NOT to use

·This IS always needed — there is no scenario where skipping base config is appropriate

How it compares

vs Cisco ASA base configASA uses security-levels per interface and stateful inspection by default. Palo Alto uses App-ID zones — all traffic is denied by default until a security policy explicitly allows it. Palo Alto requires defining zones and policies before any traffic flows.

vs Fortinet FortiGateFortiGate has a similar WebUI approach and candidate config model. FortiGate's base config syntax differs (FortiOS uses config/edit/next/end blocks). Both support centralized management (Panorama vs FortiManager).

Prerequisites

→Console cable or OOB access for initial setup — DHCP is enabled on mgmt by default
→License activated (hardware serial number or VM auth key) before threat prevention features work
→DNS server IPs — needed for license activation, dynamic updates, and URL filtering
→Panorama IP if using centralized management — register before configuring data plane

Config Generator

Hostname *

Domain

Management IP *

Management Netmask *

Management Gateway *

Primary DNS

Secondary DNS

Primary NTP

Secondary NTP

Timezone

Admin Password *

Additional Admins

Panorama Server IP (optional)

Syslog Server IP (optional)

Verification commands

show system info

Verify hostname, IP, software version, and license status

ExpectedShows system hostname, management IP, PAN-OS version, and serial number

show ntp

Verify NTP synchronization status

ExpectedShows primary/secondary NTP server and sync status. 'synchronized' means clock is accurate.

show admins

Show currently logged-in admin sessions

ExpectedLists admin username, source IP, session type (web/CLI), and login time

show system software status

Verify threat content packages are up to date

ExpectedShows application/threat, antivirus, URL filtering versions and last update time

Debug commands

test dns-query host google.com

Test DNS resolution from the management plane

Common mistakes & fixes

SymptomCannot reach management interface after config

CauseManagement IP/mask/gateway misconfigured, or management network firewall blocking access

FixUse console access to verify: 'show system info'. Correct with 'set deviceconfig system ip-address <ip>' then commit.

SymptomCommit fails with 'configuration invalid'

CauseSyntax error in 'set' commands, or referenced object doesn't exist

FixReview commit errors: 'commit' will list specific validation failures. Correct each error before committing.

SymptomPanorama shows device as disconnected

CauseWrong Panorama IP, firewall/route blocking TCP 3978 to Panorama, or device not licensed

FixTest: 'ping source management host <panorama-ip>'. Verify 'set deviceconfig system panorama-server' is set. Check device is licensed.

Further learning

Recommended books to go deeper on this topic.

CCNA 200-301 Official Cert Guide Library

Wendell Odom · Cisco Press · Best starting point for Cisco IOS fundamentals — CLI, interfaces, basic routing

Kindle ↗Hardcover ↗

CCNP Enterprise Core ENCOR 350-401 Official Cert Guide

Brad Edgeworth et al. · Cisco Press · For engineers ready to go deeper — routing, switching, security, automation