Palo Alto Panorama
MCP Server
- Source:
iflow-mcp-cdot65-palo-alto-mcp / palo-alto-mcp
- Command:
$PANOS_MCP_CMD
- Transport: stdio
- Requires:
PANOS_HOSTNAME, PANOS_API_KEY
- Preferred use: read-only audit and validation; gate policy writes behind ServiceNow CRs
How to Call the MCP Tools
python3 $MCP_CALL "$PANOS_MCP_CMD" TOOL_NAME '{"param":"value"}'
Typical Tool Coverage
- Device groups and managed firewalls
- Templates and template stacks
- Security policy rule search
- NAT policy review
- Address objects, services, tags, and zones
- Commit queues and recent job status
When to Use
- “Can host A reach host B through Palo Alto?”
- Policy hygiene reviews and duplicate-rule cleanup
- Pre-change dependency analysis on Panorama-managed estates
- Commit validation after approved firewall changes
Workflow: Rule Impact Analysis
- Resolve the relevant device group and target firewalls.
- Search security and NAT policies using source, destination, application, and service.
- Review address objects, dynamic tags, and zones tied to the traffic path.
- If a policy change is required, create and approve a ServiceNow CR before any write action.
- Verify commit status and post-change traffic behavior.
Integration with Other Skills
| Skill |
Integration |
servicenow-change-workflow |
Required for Panorama policy writes and commits |
slack-network-alerts |
Deliver firewall findings and blocked-path summaries |
te-path-analysis |
Correlate blocked or impaired paths with external reachability |
netbox-reconcile |
Map firewall objects to source-of-truth IP ownership |
Important Rules
- Never push firewall policy without approved change control
- Always check Panorama commit status after a write
- Policy hit counts and logs should validate the outcome
Failure Behavior
- If a tool call fails with an authentication or connection error, check that
PANOS_API_KEY, PANOS_HOSTNAME, PANOS_MCP_CMD are set and valid before assuming a data or device problem.
- On a tool error (timeout, unreachable host, malformed response), report the failure and its error message directly to the user rather than fabricating or guessing at results.
- For a confirmed read-only call, check connectivity and retry once if appropriate. For any call that changes state or sends a message, a timeout does not prove the action failed: inspect current state or delivery status before retrying, preserve the required approval/change gates, and do not repeat an action whose outcome is unknown.
