How do you debug policy match issues using the CLI in palo alto firewall

test security-policy-match

This command simulates traffic (without generating real packets) and tells you exactly which policy rule would match that traffic, along with the action taken.

test security-policy-match source <source-ip> destination <destination-ip> protocol <protocol> destination-port <port>


Optional Parameters

from <zone> – Source zone

to <zone> – Destination zone

application <app-name> – Optional

category <url-category> – Optional