Using Panhandler to Setup NGFW and Panorama

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Community Team Member

General Graphics copy.jpg


The IronSkillet Day One Configuration templates are baseline configurations that you can import to your Next-Generation Firewall or Panorama. The templates are based on existing best practice recommendations from Palo Alto Networks. These pre-built configurations can be valuable for green-field deployments or can be used to merge with configurations from existing environments. This reduces configuration errors and improves your environment's security posture by adopting best practices instantly.


Now, how can you take advantage of these Best-Practice configurations? A great way to do so is by using Panhandler. It is an open-source application that allows you to import playback skillets listed on GitHub using a web interface. 




  • Panhandler runs inside a docker container. The installation platform must support a docker environment. Download Docket Desktop here.
  • Once downloaded, ensure that Docker Desktop is running. 


Screen Shot 2022-07-15 at 12.15.08 AM.png




Open up your terminal and enter the following command. 



curl -s -k -L | bash




After entering the command, allow it some time to download. Yours will look different than mine as it is already downloaded. At the end you should receive an output of "You may now use Panhandler by opening a web browser and browsing to http://localhost:PORT#"




admin@M-W39VQNK6T7 ~ % curl -s -k -L | bash

  Welcome to Panhandler
  Checking 21a10cd48dec
  Checking for image updates ... (This may take some time while the image downloads)
  paloaltonetworks/panhandler:latest is already up to date!
  Found container id of 21a10cd48dec
  Checking 21a10cd48dec
  This container is up-to-date!
  Panhandler is already up to date. Ensuring it's running
  You may now use Panhandler by opening a web browser and browsing to http://localhost:8080
admin@M-W39VQNK6T7 ~ % 




Voila! Panhandler is now downloaded. 


Accessing Panhandler


Open up your web browser and enter the localhost and port specified during your download. If you have issues with getting no response from the localhost. Try restarting the docker process. 


To view the container ID of Panhandler, enter the command "docker container ls"



admin@M-W39VQNK6T7 ~ % docker container ls
CONTAINER ID   IMAGE                                COMMAND                  CREATED          STATUS         PORTS                    NAMES
21a10cd48dec   paloaltonetworks/panhandler:latest   "/app/cnc/tools/"   39 minutes ago   Up 4 seconds>8080/tcp   panhandler



 Then enter the command "docker restart 21a10cd48dec"


When you are able to access Panhandler, you will be prompted with a login. Enter the default credentials (paloalto/panhandler).


Screen Shot 2022-07-15 at 12.42.18 AM.png


When you're logged in you will see all the skillets available for use! 


Screen Shot 2022-07-15 at 12.53.21 AM.png


Skillets are available for PAN-OS, Panorama, and have base configs for PAN-OS version 10.1. You can submit configurations by configuring the target information of your desired Firewall or Panorama. Additionally, you can receive full XML and set commands to manually import/enter it onto your target device. 


Additional Resources


Feel free to share your questions, comments and ideas in the section below.


Thank you for taking time to read this blog.

Don't forget to hit the Like (thumbs up) button and to Subscribe to the LIVEcommunity Blog area.


Until next time, 


  • 325 Subscriptions
Register or Sign-in