>
    Strata Copilot
    Prisma Agent Commands (PACli)
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Agent
    3. Troubleshoot Prisma Agents
    4. Prisma Agent Commands (PACli)
    Download PDF
    Prisma Agent

    Prisma Agent Commands (PACli)

    Table of Contents

    Prisma Agent Commands (PACli)

    Learn about the Prisma Agent commands that you can run on the Prisma Access command-line tool.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Strata Cloud Manager)
    • Prisma Access (Managed by Panorama)
    • NGFW (Managed by Panorama)
    • Check the prerequisites for the deployment you're using
    • macOS, Windows, or Linux devices
    You can run Prisma Agent commands using the Prisma Access command line (PACli) tool to gain visibility into your Prisma Agent deployment. You can run the Prisma Agent commands on behalf of a user in a terminal session on the endpoint itself or in a remote shell.

    Usage

    To issue Prisma Agent commands on the Prisma Access command-line tool, use the following syntax:
    • For macOS agents:
      /Applications/Prisma\ Access\ Agent.app/Contents/Helpers/pacli /? | [command] [/? | help | options]]
    • For Windows agents:
      "C:\Program Files\Palo Alto Networks\Prisma Access Agent\pacli" /? | [command] [/? | help | options]]
    • For Linux agents:
      pacli /? | [command] [/? | help | options]]
    If you enter the pacli command without arguments or with the /? option, the list of available Prisma Agent commands is displayed.
    If you set up an environment variable for the PACli tool (pacli), you can just enter pacli <command> without the folder path.
    The following tables contain descriptions of the Prisma Agent commands and associated options that you can run on the Prisma Access command line. In the command input and output, the terms "EPM" and "epm" refer to the Endpoint Manager or Prisma Agent Manager (also known to end users as the server). The Endpoint Manager communicates with the agent, such as sending commands and configurations to the agent, routing authentication requests to the Cloud Identity Engine, and once authenticated, providing the agent with a token for the gateways.
    (macOS and Windows agents only) Some commands also support integration with third-party applications, such as a unified login portal, that need to programmatically control Prisma Agent authentication and connectivity without user interaction with the agent. These commands and their expected JSON response fields are listed in order of use in Commands for Third-Party Integration below.
    CommandDescription
    versionShows the version of the Prisma Agent that’s running on the endpoint
    captive-portal(Not supported on Prisma Agent Linux) Shows the presence of a captive portal with the pacli captive-portal status command
    connectCreates a tunnel connection for Prisma Agent traffic by connecting to a gateway.
    • To connect to a location, enter pacli connect <gateway name>
    • To get a list of the Prisma Access locations where your users can connect to, enter pacli gateway
      To connect to the best available location, enter pacli connect --best
    disconnectStops the tunnel connection by disconnecting from the gateway
    connection(macOS and Windows agents only) Shows information about the Prisma Agent gateway connection. You can use the following options with the command:
    • (no option)—Shows the most recent gateway connection attempt. Each entry includes:
      • Connection trigger—The reason the agent initiated the connection attempt (for example, machine resumed from suspension, network restored, or user-initiated action)
      • Gateway selection—The gateway the agent attempted to connect to, and whether it was selected as the preferred gateway or the best available gateway
      • Tunnel protocol—Whether the agent attempted an IPSec or SSL tunnel, and whether it succeeded or failed
      • Connection result—Whether the agent connected successfully, connected internally (via Internal Host Detection), or could not establish a tunnel
    • history—Shows a chronological log of all gateway connection attempts. Use this command to verify that the agent is connecting to the expected preferred gateway or to troubleshoot gateway selection behavior. Each entry includes:
      • Connection number—A sequential identifier for each connection attempt
      • Timestamp—The date and time of each event within the connection attempt
      • Connection trigger—The reason the agent initiated the connection attempt (for example, machine resumed from suspension, network restored, or user-initiated action)
      • Gateway selection—The gateway the agent attempted to connect to, and whether it was selected as the preferred gateway or the best available gateway
      • Machine location—The geographic location detected for the device
      • Internal host detection—Whether the agent detected an internal network and connected to an internal gateway instead of the preferred gateway
      • Tunnel protocol—Whether the agent attempted an IPSec or SSL tunnel, and whether it succeeded or failed
      • Connection result—Whether the agent connected successfully, connected internally, or could not establish a tunnel
      • Disconnection reason—The cause of a disconnection (for example, no network, machine suspended, WebSocket connection issue, token expiry, or authentication error)
    statusShows the current Prisma Agent status. You can view the following status:
    • State—Shows the state of the Prisma Agent
    • Mode—Shows the mode the Prisma Agent is running in (Always On or On Demand)
    • Tunnel—Shows the state of the Prisma Agent connection
    • HIP Status—Shows whether your device is compliant
    • EPM Status—Shows the status of the endpoint manager
    • EPM Last Seen—Shows the last time your device connected to the to the endpoint manager
    • Local Hostname—Shows the hostname of the end-user device
    protect(Not supported on Prisma Agent Linux) Enables or disables the feature that protects the Prisma Agent from being tampered with on the endpoint, such as the unauthorized uninstallation of the agent. You can specify the following options:
    • status—Displays the protection status of the Prisma Agent files and folders, Prisma Agent processes, Prisma Agent registry keys (Windows-only), and Prisma Agent services and HIP processes.
    • enable—Enables the anti-tamper feature.
    • disable—Disables the anti-tamper feature. Requires the anti-tamper unlock password.
    epmPerforms endpoint management actions using the following options:
    • status—Shows the current status of the service that manages Prisma Agents.
    • address—Sets the URL for the endpoint manager. You can add, delete, list, or set (connect) to a specified server URL.
    • signout—Disconnects the Prisma Agent from the endpoint manager and discards the token that the agent management authentication service generated. The token enables the agent to communicate with any endpoint manager component.
    • fetch—Retrieves the Prisma Agent configuration immediately.
    • set-token—Resets the token that the agent management authentication service generated. The Prisma Agent uses the token to communicate with any agent management component.
    If you enter pacli epm incorrectly or without any arguments, the list of available options is displayed.
    configManages the local configuration of the Prisma Agent. You can use the following options:
    • import—Imports the configuration from a configuration file
    • export—Exports the configuration to a file
    loglevelManipulates the logging level of Prisma Agent logs using the following options:
    • status—Shows the current verbosity level of the logs
    • set—Sets the verbosity level of the logs
    eventShows a list of Prisma Agent events
    commandTriggers a command that is sent from the server (endpoint manager) to the client (Prisma Agent).
    gatewayGets a list of the Prisma Access locations where your users can connect to
    enableEnables the Prisma Agent
    disableDisables the Prisma Agent. Requires the anti-tamper unlock password.
    hipRuns host information profile actions:
    • status—Shows the current HIP status
    • version—Shows the version of the HIP library
    • resend—Sends a HIP report to the current Prisma Access location and endpoint manager
    • update—Updates the HIP library (if an update is available)
    • notification—Shows the HIP notifications that the agent received
    mdm(Windows agents) Shows the MDM compliance status of the device. The command displays the following information:
    • Device MDM Compliant—Shows whether the device is compliant with the MDM policies configured in your MDM tenant
    • Last Compliance Check—Shows the date and time of the last MDM compliance check
    • Device Serial Number Used For Verification—Shows the device serial number used to query the MDM tenant
    tunnelShows the status of the tunnel, including the name and IP address of the Prisma Access location, and the type of tunnel that has been established. Also shows the MTU size and the volume of data that the agent transmitted and received.
    pmtu(Prisma Agent 26.4.3 and later, Windows and macOS only) Calculates the PMTU that the agent would set for a specific IPv4 address, such as a gateway IP address. Enter pacli pmtu <ipv4_address>. You don't need a connected tunnel or any configuration to use this command, and IPv6 addresses aren't supported. If the agent isn't tracking the IP address yet, the command starts discovery for it. The command shows the following values:
    • MSS-based PMTU—The PMTU calculated from the TCP MSS of a connection to the IP address
    • ICMP-discovered PMTU—The PMTU found by sending ICMP probes of different sizes
    • OS PMTU cache—The Windows PMTU cache value for the IP address, which shows N/A on macOS
    The output can include the following special values:
    • Calculating—Discovery is still running. For ICMP, the output also shows the probe size being tested.
    • N/A (connection failed)—MSS discovery found no value.
    • not found in cache—Windows has no entry for the IP address.
    • rerun in a few seconds—Discovery didn't finish within 10 seconds, so run the command again.
    The command checks every 500 milliseconds for up to 10 seconds and updates the output in place.
    getlogsCreates a zip package of all local Prisma Agent logs.
    adem(Not supported on Prisma Agent Linux) Shows the current status of the Autonomous DEM agent (if it is installed on the endpoint).
    project(Not supported on Prisma Agent Linux) Allows you to connect to a different project for Dynamic Privilege Access enabled agents. You can enter one of the following options:
    • logout—Log out of the current project.
    • login <project_name>—Log in to a project by specifying the project name. The maximum length for the project name is 32 characters.
    • list—Show the list of projects that the user has access to.
    For example, to log in or to switch to a project, enter pacli login my_project.
    trafficShows the agent's traffic forwarding rules and the traffic routing logs respectively, such as how traffic is routed for each connection and whether it is through the tunnel or directly to the internet. This command will print the active rules in a tabular format on the command line. You can use the following options:
    • show—Show the traffic forwarding rules in a forwarding profile
    • show <n>—Show a specific traffic forwarding rule by specifying the row number
    • log—Show the entries in the network connection (traffic routing) log
    • log <n>—Show a specific row in the network connection log by specifying the row number
    • export <filename>—Export the traffic forwarding rules to a file
    • import <filename>—Import the traffic forwarding rules from a file
    • user-location—Shows the user's currently detected locations, including the detection method (reverse DNS or private IP address match) and which forwarding profile rules apply
    switchtoSwitches between the Prisma Agent and the GlobalProtect app, if both apps are installed on an endpoint. You can enter one of the following options:
    • GlobalProtect—Switches to the GlobalProtect app. Requires the anti-tamper unlock password.
    • PrismaAccessAgent—Switches to the Prisma Agent.
    Switching to an app will automatically disable the previously active app.
    wpp(Windows agents) Enables Prisma Agent driver logging using the Windows software trace preprocessor (WPP) (Windows-only). You can start, stop, or reset the software trace preprocessor.
    dlp status(Not supported on Prisma Agent Linux) Shows the status for the Endpoint Data Loss Prevention feature.
    proxy(Not supported on Prisma Agent Linux) Manages the local proxy functionality. You can use the following options with the command:
    • status—Show the local proxy status
    • enable—Enable the local proxy
    • disable—Disable the local proxy
    browser(Not supported on Prisma Agent Linux) Manages the Prisma Agent embedded browser. You can use the following options with the command:
    • status—Show the current browser setting
    • internal—Set the embedded browser for Prisma Agent authentication.
    • system—Set the default system browser for Prisma Agent authentication.
    eie(Not supported on Prisma Agent Linux) Manages Prisma Agent endpoint insights. You can use the following options with the command:
    • status—Show the endpoint insights status
    • enable—Enable endpoint insights
    • disable—Disable endpoint insights
    • report -d "<description>"—User issue reporting with description to trigger the collection of diagnostics and, when self-healing is enabled, automatically apply remediation steps. Replaces the deprecated trigger command.
    • heal status—Show whether self-healing is enabled
    • heal enable—Enable self-healing
    • heal disable—Disable self-healing
    • sessions—List recent Endpoint Insights sessions
    • sessions <id>—Show details for a specific session
    (macOS and Windows agents only) You can also use Prisma Agent commands to integrate with a third-party app to programmatically control authentication and connectivity.

    © 2026 Palo Alto Networks, Inc. All rights reserved.