• AUDIT
  • DEPLOY
  • VERIFY
  • HUMAN

How to manage firewall configurations with your AI

Connect your agent to PAN-OS once. After that, you can audit pending changes and push updates through your chat interface.

Ask AI about this page

Short answer

Can I manage PAN-OS firewall changes with my AI?

Yes. Your agent uses the PAN-OS connector to inspect pending changes and commit them to the running configuration. You'll see exactly what's slated to change before you push it live.

The outcomes

What you get from your agent

Your agent handles the technical heavy lifting of configuration management.

AUDIT

Review pending changes

The AI pulls all uncommitted changes from the candidate configuration. You see exactly what's waiting to be applied.

DEPLOY

Push live updates

Once you're ready, your agent commits the changes. This moves the candidate configuration into the running configuration.

VERIFY

Confirm device state

The agent checks if the system is ready for a commit. You'll know if there are conflicts before you try to deploy.

HUMAN

Final decision control

The AI won't execute a commit without your permission. You stay in control of the actual deployment timing.

The workflow

What your AI does when the request arrives.

The agent acts as the bridge between your natural language and the PAN-OS management interface.

  1. Inspect candidate config

    The agent looks at the configuration currently sitting in the buffer that hasn't been applied to the running set yet.

    get_pending_changes

  2. Analyze differences

    It compares the pending changes against the active configuration so you can understand the impact of the update.

    get_pending_changes

  3. Execute the commit

    When you give the signal, the agent pushes the candidate configuration to the running configuration.

    commit

  4. Finalize changes

    The agent ensures the commit process completes so the new rules are active on the firewall.

    commit

Try it

Copy these to start.

Use these prompts to begin managing your PAN-OS device.

Starting points

These are opening lines. Swap out the specific firewall names or change types to match your environment.

PAN-OS Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_83HmcpYgcle8KqQOcz9GWLbtyUqjN3KZeuMd25f4/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — PAN-OS capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "pan-os-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_83HmcpYgcle8KqQOcz9GWLbtyUqjN3KZeuMd25f4/mcp"
    }
  }
}
Copy into chat04

  • Show me all the pending changes on my firewall.

  • What changes are currently waiting to be committed?

  • Commit the pending changes to the running configuration now.

  • Check if there are any uncommitted updates on the PAN-OS device.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect PAN-OS once, then ask.

Link your PAN-OS credentials to the MCP. Your login stays encrypted on our side, and you can start managing configs immediately.

Connect PAN-OS to your AI

FAQ

How this task behaves

  • 01

    Can the AI automatically commit changes?

    No. The agent only performs a commit when you explicitly tell it to.

  • 02

    Can the AI delete existing firewall rules?

    No. The tools only allow for viewing pending changes and committing them.

  • 03

    Does the AI need a separate login for the firewall?

    You provide the credentials to the MCP, which then allows your agent to communicate with the PAN-OS interface.

  • 04

    Can I see what will change before I commit?

    Yes. You can ask the agent to show you the pending changes first.

  • 05

    Will the AI change my running configuration without asking?

    No. The agent only interacts with the running configuration when you trigger a commit command.

  • More questions about PAN-OS? The Connector page answers them. See everything the PAN-OS Connector can do

Connect PAN-OS to Claude, Cursor, ChatGPT & more