Saucepan

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Testing PAN-OS ======
This page lists various methods for testing configuration on a Palo Alto Networks firewall

=====Set VSYS=====
If you are working on a multi-vsys appliance, use the following command to switch to the appropriate vsys.
<code>set system setting target-vsys <vsys-name></code>
===== Test Managment Connectivity =====
The following test command can be used to see if the managment interface can establish connectivty to a remote host. 
<code>test http-server port 443 address updates.paloaltonetworks.com protocol HTTPS</code>
===== Test Panorama Firewall Connections =====
To list the connections from firewalls to Panorama's managment interface on Panorama, us the following command.
<code>show netstat numeric-hosts yes numeric-ports yes | match 3978</code>
=====Authentication Profiles=====
====LDAP====
<code>test authentication authentication-profile LDAP-Profile username User4-LDAP password</code>
====Kerberos====
<code>test authentication authentication-profile Kerberos-Profile username User5-Kerberos password</code>
====RADIUS====
<code>test authentication authentication-profile RADIUS-Profile username User2-RADIUS password</code>
====TACACS+====
<code>test authentication authentication-profile TACACS-Profile username User3-TACACS password</code>
=====Security Profiles=====
====DNS Sinkholing====
To test DNS sinkholing, access one of the workstations that will be protected by the DNS sinkhole and do an nslookup on a malware domain.

To find a malware domain, log into the Palo Alto Networks support portal. Under the home tab, click "Dynamic Updates" to see the list of the latest dynamic updates.

Click on the release notes for the latest Antivirus definition.

Look for a line that has the format
<code>generic:suspicouslettering | 1 variants: com</code>

Then run <script>nslookup suspicouslettering.com</script> on the workstation.

You should get the sinkhole address back and see an entry in the threat log.

====DNS Security ====

If protection is not active, the following domains resolve to ''72.5.65.115''.

If protection is active, the following domains resolve to whatever your sinkhole is set to (e.g. ''72.5.65.111'') or nothing if block is set as the action instead of sinkhole.


To find example malicious domains, look in the release notes of the active AV file on the firewall (Setup > Dynamic Updates). Search for <code>New Spyware DNS C2 Signatures</code>

In built AV file based DNS malware detection:
<code>( name-of-threatid contains 'Suspicious DNS Query (Compromised_DNS' )
( name-of-threatid contains 'Suspicious DNS Query (generic' )</code>


Don't block Ad Tracking Domains. This will block anything that uses CNAME. This affects most major sites.

  * Ad Tracking
    * CNAME Cloaking
  * Command and Control
    * Tunnelling
    * Infiltration
    * NXNS
    * Rebinding
    * DGA
  * Dynamic DNS
  * Grayware
    * FastFlux
    * Malicious NRD
    * Dangling Domain
    * Wildcard Abuse
    * Strategically Aged
  * Parked
  * Phishing
  * Proxy Avoidance
  * Newly Registered Domains

Malicious DNS queries found based on the AV filedownload are categoriesed as ''( category-of-threatid eq dns )''

<code>( subtype eq spyware ) and ( category-of-threatid eq dns-grayware ) and ( severity eq low )</code>
^ Default Log Severity ^ Threat Category ^ Test Domain ^ Test Command ^
| informational | dns-adtracking | test-adtracking.testpanw.com | dig +short @8.8.8.8 A test-adtracking.testpanw.com |
| informational | dns-adtracking | test-cname-cloaking.testpanw.com | dig +short @8.8.8.8 A test-cname-cloaking.testpanw.com |
| high | dns-c2 | test-c2.testpanw.com | dig +short @8.8.8.8 A test-c2.testpanw.com |
| high | dns-c2 | test-dnstun.testpanw.com  | dig +short @8.8.8.8 A test-dnstun.testpanw.com |
| high | dns-c2 | test-dns-infiltration.testpanw.com | dig +short @8.8.8.8 A test-dns-infiltration.testpanw.com |
| high | dns-c2 | test-nxns.testpanw.com | dig +short @8.8.8.8 A test-nxns.testpanw.com |
| high | dns-c2 | test-dns-rebinding.testpanw.com | dig +short @8.8.8.8 A test-dns-rebinding.testpanw.com |
| high | dns-c2 | test-dga.testpanw.com | dig +short @8.8.8.8 A test-dga.testpanw.com |
| informational | dns-ddns | test-ddns.testpanw.com | dig +short @8.8.8.8 A test-ddns.testpanw.com |
| low | dns-grayware | test-grayware.testpanw.com | dig +short @8.8.8.8 A test-grayware.testpanw.com |
| low | dns-grayware | test-fastflux.testpanw.com | dig +short @8.8.8.8 A test-fastflux.testpanw.com |
| low | dns-grayware | test-malicious-nrd.testpanw.com | dig +short @8.8.8.8 A test-malicious-nrd.testpanw.com |
| low | dns-grayware | test-dangling-domain.testpanw.com | dig +short @8.8.8.8 A test-dangling-domain.testpanw.com |
| low | dns-grayware | test-wildcard-abuse.testpanw.com | dig +short @8.8.8.8 A test-wildcard-abuse.testpanw.com |
| low | dns-grayware | test-strategically-aged.testpanw.com | dig +short @8.8.8.8 A test-strategically-aged.testpanw.com |
| medium | dns-malware | test-malware.testpanw.com | dig +short @8.8.8.8 A test-malware.testpanw.com |
| medium | dns-malware | test-compromised-dns.testpanw.com | dig +short @8.8.8.8 A test-compromised-dns.testpanw.com |
| informational | dns-parked | test-parked.testpanw.com | dig +short @8.8.8.8 A test-parked.testpanw.com |
| low | dns-phishing | test-phishing.testpanw.com | dig +short @8.8.8.8 A test-phishing.testpanw.com |
| low | dns-proxy | test-proxy.testpanw.com | dig +short @8.8.8.8 A test-proxy.testpanw.com |
| low | dns-new-domain | test-nrd.testpanw.com | dig +short @8.8.8.8 A test-nrd.testpanw.com |

<code>show dns-proxy dns-signature info</code>
<code>test dns-proxy dns-signature fqdn</code>



<code>dig +short @8.8.8.8 A test-adtracking.testpanw.com
dig +short @8.8.8.8 A test-cname-cloaking.testpanw.com

dig +short @8.8.8.8 A test-c2.testpanw.com
dig +short @8.8.8.8 A test-dnstun.testpanw.com
dig +short @8.8.8.8 A test-dns-infiltration.testpanw.com
dig +short @8.8.8.8 A test-nxns.testpanw.com
dig +short @8.8.8.8 A test-dns-rebinding.testpanw.com
dig +short @8.8.8.8 A test-dga.testpanw.com

dig +short @8.8.8.8 A test-ddns.testpanw.com

dig +short @8.8.8.8 A test-grayware.testpanw.com
dig +short @8.8.8.8 A test-fastflux.testpanw.com
dig +short @8.8.8.8 A test-malicious-nrd.testpanw.com
dig +short @8.8.8.8 A test-dangling-domain.testpanw.com
dig +short @8.8.8.8 A test-wildcard-abuse.testpanw.com
dig +short @8.8.8.8 A test-strategically-aged.testpanw.com

dig +short @8.8.8.8 A test-malware.testpanw.com
dig +short @8.8.8.8 A test-compromised-dns.testpanw.com

dig +short @8.8.8.8 A test-parked.testpanw.com

dig +short @8.8.8.8 A test-phishing.testpanw.com

dig +short @8.8.8.8 A test-proxy.testpanw.com

dig +short @8.8.8.8 A test-nrd.testpanw.com</code>
====Vulnerability Protection====
As listed in this [[https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Check-if-the-Vulnerability-Module-is-Working-Properly/ta-p/56519|article]].
  - Go to any http site with a search bar.
  - Enter the following in the search bar and then click the search button: <code><script>test</script></code>
  - A vulnerability log should be generated under the threat log. This shows that the vulnerability profile is working properly and generating log entries.
====Antivirus====
Try and download the following harmless test file from EICAR (European Institute for Computer Anti-Virus Research) that all Antivirus vendors should flag as 'malware'.
<code>http://www.eicar.org/download/eicar.com
http://www.eicar.org/download/eicar.com.txt
http://www.eicar.org/download/eicar_com.zip
http://www.eicar.org/download/eicarcom2.zip
https://secure.eicar.org/eicar.com
https://secure.eicar.org/eicar.com.txt
https://secure.eicar.org/eicar_com.zip
https://secure.eicar.org/eicarcom2.zip</code>
====WildFire Protection====
Download this file and see if WildFire protects against it. Make sure that there is a WildFire policy checking for PE files.
Palo's test web site is [[https://docs.paloaltonetworks.com/wildfire/9-0/wildfire-admin/submit-files-for-wildfire-analysis/verify-wildfire-submissions/test-a-sample-malware-file.html#|here]]. 

You should get a result within 5 - 10 minutes. I found I normally get results for the test file within 7 minutes.

I found on one deployment (lab) that I had to disable the decryption excption for *.wildfire.paloaltonetworks.com to get this working. When I tested and then re-enabled the exception, things continued to work fine.
(Device->Certificate Managment->SSL Decryption Exclusion->Seach for wildfire, select it and disable it.)
<code>http://wildfire.paloaltonetworks.com/publicapi/test/pe</code>
To test WildFire uploades, log into the CLI and run the following and look for <code>upload success</code>
<code>debug wildfire upload-log show</code>
If you have SSL decryption enabled...
  * PE <code>https://wildfire.paloaltonetworks.com/publicapi/test/pe</code>
  * APK <code>https://wildfire.paloaltonetworks.com/publicapi/test/apk</code>
  * MacOSX <code>https://wildfire.paloaltonetworks.com/publicapi/test/macos</code>
  * ELF <code>https://wildfire.paloaltonetworks.com/publicapi/test/elf</code>
If you do NOT have SSL decryption enabled...
  * PE <code>http://wildfire.paloaltonetworks.com/publicapi/test/pe</code>
  * APK <code>http://wildfire.paloaltonetworks.com/publicapi/test/apk</code>
  * MacOSX <code>http://wildfire.paloaltonetworks.com/publicapi/test/macos</code>
  * ELF <code>http://wildfire.paloaltonetworks.com/publicapi/test/elf</code>

==== DoS Protection ====
You can test DoS Protection (TCP/flood). In the following command, we run a slowloris attack (dos attack to see if the web server can cope with move than 10 concurrent sessions.
<code>nmap --script http-slowloris --max-parallelism 10 <target_ip></code>
  * ** --script http-slowloris** "Test web server target for slowloris culnerbaility"
  * ** --max-parallelism <num>** "Open <num> connections in parallel"

**REMEMBER** 
Press the up arrow as the scan runs to get updates on progress.

**You just want the 'Connect Scan Timing' bit.**

This will take a few seconds to run and then it will start ''NSE Timing'' which will take ages and we don't need. Use CTRL+C to cancel the attack test when we reach this bit.
==== Zone Protection ====
As listed in this [[https://live.paloaltonetworks.com/t5/Management-Articles/Zone-Protection-Profile-Not-Generating-Logs-During-Penetration/ta-p/60563|article]].

Run nmap against an address hosted within the target zone with this command
<code>nmap -p 1-65535 -T4 -A -v <target_ip></code>


=== TCP Scan Attack ===
<code>nmap -v1 -Pn -T4 --max-retries 1 <target_ip></code>
  - -v1 "Set verbosity level to 1"
  - -Pn "Skip host discovery by treating all hosts as online"
  - -T4 "Use template 4 (provides faster command execution)"
  - --max-retries 1 "Retry only once if port is unreachable"





If you have Zone Protection enabled, you will notice that there will be very few Threat logs created when Zone protection drops traffic.

To see if Zone protection is doing anything, you will need to run the following command <code>show counter global filter packet-filter yes delta yes | match Zone</code>

=== Test Spoof IP ===
The following command will spoof the source IP address. This can be defended against using the "Spoofed IP Address" option on the Zone Protection Profile. We can cause a UDP flood with the following command.
<code>hping3 --flood --rand-source --udp -p 80 192.168.1.1</code>
<code>show counter global filter packet-filter yes delta yes | match discard-ip-spoof</code>
  * Zone Protect Description : Spoofed IP Address
  * Name : flow_dos_pf_ipspoof
  * Description: Packets dropped: Zone protection option 'discard-ip-spoof'
  * Severity : drop
  * Category : flow
  * Aspect : dos

You can also use NMap
<code>nmap -e eth0 -p443 -S <source_ip> <target_ip></code>
  * **-e <interface>** "Interface to use to connect to the target host"
  * **-p<n>** "Port number to which to connect on the target host"
  * **-S <IP>** "Source IP (spoofed IP to use to connect to the target host>"

=== Test Ping Broadcast Flood ===
<code>ping -b -f 192.168.39.255 -v</code>
=== Test UDP Flood ===
The following command will cause a UDP flood
<code>hping3 -c 20000 -S -P -U -V --flood --rand-source 192.168.1.1</code>
  * **-c 20000** means we send 20000 packets
  * **-S** means set SYN flag
  * **-P** means set PUSH flag
  * **-U** means set URG flag
  * **-V** means verbose mode
  * **--flood** means we send the packets as fast as possible
  * **--rand-source** means we genreate spoofed IP addresses.
  * **192.168.1.1** the victim IP address

Logs will show up in the Threat Log.
<code>( subtype eq flood ) and ( name-of-threatid eq 'UDP Flood' ) and ( severity eq critical )</code>
<code>show counter global filter packet-filter yes delta yes | match flow_dos_red_udp</code>
  * Zone Protect Description : Flood Protection -> UDP
  * Name : flow_dos_red_udp
  * Description: Packets dropped: Zone protection protocol 'udp' RED
  * Severity : drop
  * Category : flow
  * Aspect : dos

=== Test TCP Flood ===
The following command will cause a TCP SYN flood to TCP port 80.
<code>hping3 -c 20000 -d 120 -S -w 64 -p 80 --flood --rand-source 192.168.1.1</code>
  * **-c 20000** means we send 20000 packets
  * **-d 120** means the packets are 120 bytes in size
  * **-w 64** means that the TCP window size is 64
  * **-p 80** means we are targeting TCP port 80
  * **--flood** means we send the packets as fast as possible
  * **--rand-source** means we generate spoofed IP addresses.
  * **192.168.1.1** the victim IP address

You can also use NMap
<code>nping --tcp-connect -p 80 --rate 100000 -c 10 -q <target_ip></code>
  * **--tcp-connect** "Scan using TCP mode"
  * **-p** "Port number to which we connect"
  * **--rate** "Number of packets per second to send in each round"
  * **-c** "Number of connections to complete"
  * **-q** "Reduce the output verbosity by one level which makes the output easier to read".




Logs will show up in the Threat Log.
<code>( subtype eq flood ) and ( name-of-threatid eq 'TCP Flood' ) and ( severity eq critical )</code>
<code>show counter global filter packet-filter yes delta yes | match flow_dos_red_tcp</code>
  * Zone Protect Description : Flood Protection -> UDP
  * Name : flow_dos_red_tcp
  * Description: Packets dropped: Zone protection protocol 'tcp-syn' RED
  * Severity : drop
  * Category : flow
  * Aspect : dos

=== Test ICMP Flood ===
The following command will cause a TCP SYN flood to TCP port 80.
<code>hping3 -1 -c 20000 --flood --rand-source 192.168.1.1</code>
hping3 -c 20000 -d 120 -S -w 64 -p 80 --flood --rand-source 192.168.1.1</code>
  * **-1** means we are flooding ICMP rather than TCP or UDP.
  * **-c 20000** means we send 20000 packets
  * **--flood** means we send the packets as fast as possible
  * **--rand-source** means we generate spoofed IP addresses.
  * **192.168.1.1** the victim IP address

Logs will show up in the Threat Log.
<code>( subtype eq flood ) and ( name-of-threatid eq 'TCP Flood' ) and ( severity eq critical )</code>
<code>show counter global filter packet-filter yes delta yes | match flow_dos_red_tcp</code>
  * Zone Protect Description : Flood Protection -> UDP
  * Name : flow_dos_red_tcp
  * Description: Packets dropped: Zone protection protocol 'tcp-syn' RED
  * Severity : drop
  * Category : flow
  * Aspect : dos



=== Test ICMP Protection ===
If you run a traceroute from Inside to Outside with zone protection profile applied to the outside zone.
  * Zone Protect Description : ICMP Drop -> Suppress ICMP TTL Expired Error
  * Name : flow_dos_pf_noreplyttl
  * Description: Packets dropped: Zone protection option 'suppress-icmp-timeexceeded'
  * Severity : drop
  * Category : flow
  * Aspect : dos
  * 
If you run a traceroute from Inside to Outside with zone protection profile applied to the inside zone.
  * Zone Protect Description : ICMP Drop -> Discard ICMP embedded with error message
  * Name : fflow_dos_pf_icmperr
  * Description: Packets dropped: Zone protection option 'discard-icmp-error'
  * Severity : drop
  * Category : flow
  * Aspect : dos

=== Test ICMP Large Packet Protection ===
You can run the following command on Windows.
<code>ping -t -l 65500 192.168.1.1 </code>
Or, if you are on Linux
<code>ping -t -s 65500 192.168.1.1</code>
<code>show counter global filter packet-filter yes delta yes | match discard-icmp-large-packet</code>
  * Zone Protect Description : Zone Protect Description : ICMP Drop -> ICMP Large Packet(>1024)
  * Name : flow_dos_pf_icmplpkt
  * Description: Packets dropped: Zone protection option 'discard-icmp-large-packet'
  * Severity : drop
  * Category : flow
  * Aspect : dos

It will also trigger the following
  * Zone Protect Description : Zone Protect Description : ICMP Drop -> ICMP Fragment
  * Name : flow_dos_pf_icmplpkt
  * Description: Packets dropped: Zone protection option 'discard-icmp-frag'
  * Severity : drop
  * Category : flow
  * Aspect : dos

=== Test IP Drops ===

Strict IP Address Check will probably trigger alerts if you run a UDP Flood as shown above.
  * Zone Protect Description : Strict IP Address Check
  * Name : flow_dos_pf_strictip
  * Description: Packets dropped: Zone protection option 'strict-ip-check'
  * Severity : drop
  * Category : flow
  * Aspect : dos

=== Test TCP Drops ===
I found the following command seems to include data in the TCP SYN packet before it triggers a flood attack (see above).
<code>hping3 -c 20000 -d 120 -S -w 64 -p 80 --flood --rand-source 192.168.1.1</code>
  * Zone Protect Description : Zone Protect Description : TCP Drop -> TCP SYN with Data
  * Name : flow_dos_pf_tcpsyndata
  * Description: Packets dropped: Zone protection option 'discard-tcp-syn-with-data'
  * Severity : drop
  * Category : flow
  * Aspect : dos

  * Zone Protect Description : Zone Protect Description : TCP Drop -> TCP SYN ACK with Data
  * Name : flow_dos_pf_tcpsynackdata
  * Description: Packets dropped: Zone protection option 'discard-tcp-synack-with-data'
  * Severity : drop
  * Category : flow
  * Aspect : dos

  * Zone Protect Description : Zone Protect Description : TCP Drop -> TCP Timestamp
  * Name : flow_dos_pm_tcptimestamp
  * Description: Packets modified: Zone protection option 'remove-tcp-timestamp'
  * Severity : info
  * Category : flow
  * Aspect : dos

  * Zone Protect Description : Zone Protect Description : TCP Drop -> TCP Fast Open
  * Name : flow_dos_pm_tcptfodata
  * Description: Packets modified: Zone protection option 'strip-tcp-fast-open-and-data'
  * Severity : info
  * Category : flow
  * Aspect : dos
=====VPN=====
Initiate IKE phase 1 by either pinging a host across the tunnel or using the following CLI command:
<code>test vpn ike-sa gateway gateway_name</code>
Then enter the following command to test if IKE phase 1 is set up:
<code>show vpn ike-sa gateway gateway_name</code>
In the output, check if the Security Association displays. If it does not, review the system log messages to interpret the reason for failure.
Initiate IKE phase 2 by either pinging a host from across the tunnel or using the following CLI command:
<code>test vpn ipsec-sa tunnel tunnel_name</code>
Then enter the following command to test if IKE phase 1 is set up:
<code>show vpn ipsec-sa tunnel tunnel_name</code>
In the output, check if the Security Association displays. If it does not, review the system log messages to interpret the reason for failure.
To view the VPN traffic flow information, use the following command:
<code>show vpn-flow </code>
You can also start all tunnels with
<code>test vpn ipsec-sa</code>
=====Test WMI=====
In some cases the WMI probe will fail because the workstation may be running a local firewall or it may not be a member of the domain. If this happens, the mapping can be deleted once the cache timeout is exceeded, even though the workstation is up and passing traffic. To test, run the following command from the User-ID Agent device (which must be connected to the Domain).
<code>wmic /node:workstationIPaddress computersystem get username</code>
E.G.
<code>> wmic /node:10.1.1.1 computersystem get username
username
example\testuser</code>
===== User-ID Group Mapping =====
To list the number of group mappings, run the following command.
<code>show user group list</code>
To list the members of a particular group show in the results of the previous command, run the following command.
<code>show user group name "cn=some groupname with whitespace,ou=AnOUname,ou=AnotherOUname,dc=example,dc=com"</code>
To force the Palo to refresh the members of groups from a particular group mapping, run the following.
<code>debug user-id reset group-mapping NameOfGroupMapping</code>


=====Good Tests to Run After Deploying a New Palo Alto Networks Firewall=====
==Gratuitous ARP==
If devices upstream of the Palo firewall cannot be updated to refresh their ARP cache, try runninging the following command to force an ARP cache update.
<code>test arp gratuitous ip <ip/netmask> interface <interface name></code>
==DNS==
Ensure the managment plane can successfully perform DNS lookups with a ping command to a FQDN (required PANOS 8.0 or later).
<code>request resolve address eu.wildfire.paloaltonetworks.com</code>

==NTP==
Ensure that the NTP servers configured are actually usable.
<code>show ntp</code>
You can test NTP manually using Windows using <code>w32tm /stripchart /computer:192.168.1.1</code>
==Ensure that PANDB is Reachable==
If the firewall is licenced for PANDB URL filtering, make sure that the firewall has successufully connected to the PANDB cloud.
<code>show url-cloud status</code>
==Ensure WildFire Connectivity==
If the firewall is licenced for WildFire, make sure it can communicate with the WildFire cloud.
<code>test wildfire registration channel public</code>
==Check Duplex Settings==
For every physical interface, run the following command an ensure that the speed is 1000/full (or 100/full if it is connected to a 100Mb appliance).
<code>show interface ethernet1/1 | match duplex </code>
==Arp Table==
Make sure the Arp table is not full. Specifically, don't configure a /16 subnet on a small firewall (e.g. PA-220) as this may well cause your ARP table to flood which will lead to session failure.
<code>show arp all</code>
==System Files==
<code>show system files</code>
<code>show system disk-space</code>
==System Environmentals==
Ideal operating temperature is 1C to 27C; Operating temperature can span from 0C to 50C. 
<code>show system environmentals</code>
==Logs==
<code>debug log-receiver statistics</code>
==Resourse History==
<code>show running resource-monitor</code>
<code>show system software status</code>

==Example Results==
Here are example results of the tests above.

<code>username@hostname> request resolve address bbc.co.uk

151.101.64.81
151.101.0.81
151.101.128.81
151.101.192.81
2a04:4e42::81
2a04:4e42:600::81
2a04:4e42:400::81
2a04:4e42:200::81</code>

<code>username@customerfirewall> show ntp
NTP state:
    NTP synched to 192.168.1.100
    NTP server: 192.168.1.100
        status: synched
        reachable: yes
        authentication-type: none
    NTP server: 192.168.1.101
        status: available
        reachable: yes
        authentication-type: none</code>

<code>username@customerfirewall> show url-cloud status

PAN-DB URL Filtering
License :                          valid
Current cloud server :             s0300.urlcloud.paloaltonetworks.com
Cloud connection :                 connected
Cloud mode :                       public
URL database version - device :    20180814.40125
URL database version - cloud :     20180814.40125  ( last update time 2018/08/15 11:31:45 )
URL database status :              good
URL protocol version - device :    pan/0.0.2
URL protocol version - cloud :     pan/0.0.2
Protocol compatibility status :    compatible</code>

<code>username@customerfirewall> test wildfire registration channel public
This test may take a few minutes to finish. Do you want to continue? (y or n)

Test wildfire Public Cloud

        Testing cloud server eu.wildfire.paloaltonetworks.com ...
        wildfire registration:         successful
        download server list:          successful
        select the best server:        eu-panos.wildfire.paloaltonetworks.com</code>

<preusername@customerfirewall> show interface ethernet1/1 | match duplex
  Runtime link speed/duplex/state: 1000/full/up
  Configured link speed/duplex/state: auto/auto/auto</code>

<code>username@customerfirewall> show arp ethernet1/1

maximum of entries supported :      1500
default timeout:                    1800 seconds
total ARP entries in table :        1
total ARP entries shown :           1
status: s - static, c - complete, e - expiring, i - incomplete

interface         ip address      hw address        port              status   ttl
--------------------------------------------------------------------------------
ethernet1/1       192.168.10.10   ab:cd:ef:12:34:56 ethernet1/1         c      1290</code>



This is an example of bad NTP
<code>username@customerfirewall> show ntp

NTP state:
    NTP not synched, using local clock
    NTP server: 192.168.1.1
        status: rejected
        reachable: no
        authentication-type: none
    NTP server: 192.168.1.2
        status: rejected
        reachable: no
        authentication-type: none</code>

======Search Log Files======
If you want to search a whole log file...
<code>grep pattern "pattern_to_search" mp-log *</code>