Skip to content

Palo Alto Networks: CLI (PAN-OS CLI)

Apply the same fix as the GUI guide from the PAN-OS command line: SSH to the firewall's management interface, enter configure mode, create the object and rules with set commands, commit, then confirm the result with test and show commands.

Before you start

Review the Palo Alto Networks overview. You will need:

  • SSH access to the firewall's management interface with an admin role that can edit policy
  • <RTA_SOURCE_ZONE>: the security zone where the RTA appliance lives
  • <INTERNET_ZONE>: your internet/untrust zone
  • <RTA_IP>: the RTA's IP address (used by the verify test commands)

Locally managed, single vsys

The commands below target a locally managed firewall with a single vsys. On a multi-vsys firewall, prefix the rule commands with vsys <vsys#> (for example move vsys vsys1 rulebase security rules ...); if Panorama manages your rulebase, make the equivalent changes there instead.

Quick fix

Experienced operators can run the whole sequence below; each command is explained in the sections that follow.

configure
set address rta-connect-endpoint fqdn connect.remotetesting.secureworks.com
set rulebase decryption rules no-decrypt-rta-connect from <RTA_SOURCE_ZONE> to <INTERNET_ZONE> source any destination rta-connect-endpoint service any category any action no-decrypt type ssl-forward-proxy
move rulebase decryption rules no-decrypt-rta-connect top
set rulebase security rules allow-rta-openvpn from <RTA_SOURCE_ZONE> to <INTERNET_ZONE> source any destination rta-connect-endpoint application [ openvpn ssl unknown-tcp ] service application-default action allow
move rulebase security rules allow-rta-openvpn top
commit

1. Enter configure mode

Log in over SSH and switch from operational mode (the > prompt) to configuration mode (the # prompt):

configure

2. Create an FQDN address object

PAN-OS resolves FQDN address objects continuously, so an FQDN object is the simplest approach:

set address rta-connect-endpoint fqdn connect.remotetesting.secureworks.com

IP-based objects instead

The endpoint also has two static IPs if you prefer an IP-based rule:

set address rta-connect-ip-1 ip-netmask 3.33.194.251/32
set address rta-connect-ip-2 ip-netmask 15.197.255.2/32

If you use these, reference both objects wherever the steps below reference rta-connect-endpoint.

3. Create a decryption exception (No Decrypt)

SSL Forward Proxy intercepts TCP/443 sessions and attempts to re-sign the certificate. Because the RTA tunnel is OpenVPN, not HTTPS, this causes an immediate session reset. Create a No Decrypt rule and move it above any existing SSL Forward Proxy decrypt rule so it matches first:

set rulebase decryption rules no-decrypt-rta-connect from <RTA_SOURCE_ZONE> to <INTERNET_ZONE> source any destination rta-connect-endpoint service any category any action no-decrypt type ssl-forward-proxy
move rulebase decryption rules no-decrypt-rta-connect top

Warning

If you use a custom URL category for your decrypt policy instead of address objects, add connect.remotetesting.secureworks.com to your "no-decrypt" URL category (Objects > Custom Objects > URL Category in the web UI) rather than (or in addition to) the address-object approach above.

4. Allow the application in security policy

Even with decryption bypassed, App-ID may classify the OpenVPN flow as the openvpn application (or unknown-tcp / non-syn-tcp) and drop it under a deny-all default rule. Create an allow rule for the destination; ssl and unknown-tcp are included as a safety net in case App-ID reclassifies during a content update:

set rulebase security rules allow-rta-openvpn from <RTA_SOURCE_ZONE> to <INTERNET_ZONE> source any destination rta-connect-endpoint application [ openvpn ssl unknown-tcp ] service application-default action allow
move rulebase security rules allow-rta-openvpn top
  • service application-default resolves to TCP/443 for openvpn.
  • To scope the rule tighter, replace source any with the RTA's IP or subnet.
  • The rule must sit above any broad deny rules; top is the simplest safe placement, or use move rulebase security rules allow-rta-openvpn before <DENY_RULE_NAME> to slot it directly above a specific rule.

Warning

If App-ID still drops the session after this rule is in place, the last resort is an Application Override, which disables App-ID and all threat inspection for the matched flow. See Option B in the GUI guide.

5. Commit

PAN-OS changes do not take effect until committed. Still in configure mode, run:

commit

Wait for the commit to complete successfully before testing, then leave configure mode:

exit

6. Verify

All of the following run in operational mode (the > prompt).

Confirm the firewall resolves the FQDN object (expect 3.33.194.251 and 15.197.255.2):

show dns-proxy fqdn all

On PAN-OS 8.1 and earlier, use request system fqdn show instead.

Confirm the security policy matches the RTA's flow (expect allow-rta-openvpn with action allow):

test security-policy-match from <RTA_SOURCE_ZONE> to <INTERNET_ZONE> source <RTA_IP> destination 3.33.194.251 destination-port 443 protocol 6 application openvpn

Confirm the decryption exception matches (expect no-decrypt-rta-connect with action no-decrypt):

test decryption-policy-match category any from <RTA_SOURCE_ZONE> source <RTA_IP> destination 3.33.194.251

To double-check rule order, review the running rulebase:

show running security-policy

Then power on (or restart) the RTA and confirm a live session establishes to the endpoint:

show session all filter destination 3.33.194.251 destination-port 443

The session's application should show openvpn and the tunnel should come up and stay up in the RTA management interface. For the log checks in the web UI (Traffic and Decryption logs), see the GUI guide's Check the logs section.