Exporting a Palo Alto firewall config for a support case or an AI-assisted troubleshooting session pulls everything in the candidate or running config at once — zone structure, security rules, NAT, and every secret PAN-OS stores alongside them. Before that goes anywhere outside the box, it's worth knowing exactly what's in it.
What a PAN-OS Config Actually Contains
phash— the local administrator password hash undermgt-config users- IKE Gateway
pre-shared-keyvalues for every VPN tunnel - SNMP
snmp-settingcommunity strings (v1/v2c) or v3 auth/privacy passwords - RADIUS, LDAP, and Kerberos
server-profilesecrets and bind passwords used for admin/GlobalProtect authentication - GlobalProtect portal and gateway pre-shared secrets and certificate passphrases
- API keys embedded in automation scripts pasted alongside the config
Before and After
The same pre-shared key or bind password always maps to the same token throughout the sanitized output, so relationships between VPN tunnels, zones, and authentication profiles stay readable — only the literal secret is replaced.
Steps
- Install ScrubForge from the Chrome Web Store (free)
- Export with
show config running(or theset-format equivalent) from the PAN-OS CLI or Panorama - Paste the output into ScrubForge
- Review the sanitized result — password hashes, pre-shared keys, and bind secrets are tokenized, structure is untouched
- Copy and share, or continue in ScrubForge's built-in AI chat
Why Local Processing Matters
An IKE pre-shared key or an admin password hash pasted into a support ticket or a shared AI chat log sits there indefinitely, outside your control. ScrubForge sanitizes entirely inside the browser tab — nothing is uploaded before you decide to share it.