Free-play Palo Alto · PAN-OS 11.1 Beta — direct URL only

Free-play Palo Alto PAN-OS console

A live in-browser Palo Alto Networks PAN-OS CLI. Enter configure, set interfaces / zones / security rules using the classic set syntax, and commit to activate them. Candidate-vs-running semantics work exactly as they do on a real firewall.

Independent educational training. Not affiliated with or endorsed by Palo Alto Networks, Inc. Palo Alto Networks® and PAN-OS® are trademarks of Palo Alto Networks.

PA-FW-01 · PAN-OS 11.1

Type configure then ? to explore. Every set mutates CANDIDATE — nothing takes effect until you commit. ↑ / ↓ for history · Tab for completion.

Try this first — a basic zone + interface + policy

configure
set network interface ethernet ethernet1/1 layer3 ip 192.168.1.1/24
set network interface ethernet ethernet1/2 layer3 ip 10.0.0.1/24
set zone trust network layer3 ethernet1/1
set zone untrust network layer3 ethernet1/2
set rulebase security rules allow-web from trust to untrust source any destination any application web-browsing action allow
show config diff
commit
exit, then show config running

Try this — edit context navigation

configure
edit rulebase security rules allow-dns
set from trust
set to untrust
set application dns
set action allow
show — see the subtree at your edit position
top, then show — full candidate
commit

Currently supported (v1)

Operational mode (show system info, show interface all, show session all, show admins, show config running, ping host, traceroute host) · Config mode (configure, exit, edit, up, top, set, delete, show, show config running|candidate|diff, commit, discard) · Candidate vs running semantics with per-command change counter · Bracketed list values ([ A B C ]) · Tab completion for top-level verbs · ? context help · --More-- pager · command history.

Not yet: schema-aware deep-path tab completion · commit validation · multi-vsys · Panorama layering · RBAC. Coming in later releases.