Palo Alto Firewall Backup Fails in Kiwi CatTools with “Did not receive expected response to command: show”

5/5/2026 3:21 PM

5/5/2026 3:21 PM

Although login to the device is successful and initial commands execute correctly, the backup process fails when CatTools attempts to run the show command.

The logs indicate that CatTools does not receive the expected response, resulting in a timeout and backup failure—even though the same commands work when executed manually via CLI.

2026-01-27 09:41:10 1-Error 1 fw-Palo Did not receive expected response to command: show
2026-01-27 09:41:10 3-Info 1 fw-Palo Backup Running Config results: Failed

Kiwi CatTools

The issue is caused by network-level packet-handling limitations, specifically MTU (Maximum Transmission Unit) settings on the CatTools server or along the network path.

Due to improper MTU size:

• CLI output from the Palo Alto firewall (especially the show command) is not fully transmitted
• Responses are fragmented or dropped
• Kiwi CatTools cannot detect the expected prompt/output
• This results in a timeout error

Resolution

1. Modify MTU Settings on the CatTools Server
   • Adjust the MTU size to a lower, stable value (commonly 1400–1472, depending on the environment)
2. Validate Network Path
   • Ensure no intermediate devices (firewalls/VPNs) are fragmenting or dropping packets
3. Re-test Backup Operation
   • Run the backup job again in Kiwi CatTools
   • Confirm that the show command now returns full output without a timeout
4. Optional Validation
   • Perform a manual CLI test via SSH from the CatTools server
   • Verify consistent and complete output

 

When running a backup config activity in Cattools, you may need to have the configurations in Set or XML format for Palo Alto devices.  

Reference: Back up Palo Alto devices in Kiwi Cattools using XML or Set Format