Upgrade a Cluster Locally without an Internet Connection
Where Can I Use
This?
What Do I Need?
WildFire Appliance
WildFire License
To upgrade a cluster locally, you must individually
upgrade each WildFire appliance enrolled in a cluster. When an appliance
finishes upgrading, it automatically re-enrolls into the cluster
that it was originally assigned to.
Temporarily suspend sample analysis.
Stop firewalls from forwarding any new samples
to the WildFire appliance.
Log in to the firewall web interface.
Select Device > Setup > WildFire and
edit General Settings.
Clear the WildFire Private Cloud field.
Click OK and Commit.
Confirm that analysis for samples the firewalls already
submitted to the appliance is complete:
admin@WF-500(passive-controller)> show
wildfire latest samples
If you do not want to wait for the WildFire appliance
to finish analyzing recently-submitted samples, you can continue
to the next step. However, consider that the WildFire appliance
then drops pending samples from the analysis queue.
Retrieve the content update file from the update server.
In the WildFire Appliance section, locate the latest
WildFire appliance content update and download it.
Copy the content update file to an SCP-enabled server
and note the file name and directory path.
Install the content update on the WildFire appliance.
Log in to the WildFire appliance and download
the content update file from the SCP server:
admin@WF-500> scp
import wf-content from username@host:path
For
example:
admin@WF-500> scp
import wf-content from bart@10.10.10.5:c:/updates/panup-all-wfmeta-2-253.tgz
If
your SCP server is running on a non-standard port or if you need
to specify the source IP, you can also define those options in the scp
import command.
From the software updates page, select WF-500
Guest VM Images and download the following VM image
files:
Palo Alto Networks periodically updates the VM image
files; as a result, the specific filename changes based on the version that
is available. Be sure to download the latest version, whereby the
m-x.x.x in the filename indicates the release number; additionally,
there is a release date that can be cross-referenced to help determine
the latest version.
WFWinXpAddon3_m-1.0.1.xpaddon3
WFWinXpGf_m-1.0.1.xpgf
WFWin7_64Addon1_m-1.0.1.7_64addon1
WFWin10Base_m-1.0.1.10base
Upload the VM images to the WildFire appliance.
Import the VM image from the SCP server:
admin@WF-500>scp import wildfire-vm-image from <username@ip_address>/<folder_name>/<vm_image_filename>
For
example:
admin@WF-500>scp import wildfire-vm-image from user1@10.0.3.4:/tmp/WFWin7_64Addon1_m-1.0.1.7_64addon1
To check the status of the download, use the following command:
admin@WF-500>show jobs all
Repeat for the remaining VM images.
Install the VM image.
admin@WF-500>request system wildfire-vm-image upgrade install file <vm_image_filename>
Repeat for the remaining VM images.
Confirm that the VM images have been properly installed
and enabled on the WildFire appliance.
(Optional) View a list of available virtual machines
images:
admin@WF-500> show wildfire vm-images
The
output displays the available VM images.
Commit the configuration:
admin@WF-500# commit
View the active VM images by running the following command:
admin@WF-500> show wildfire status
Verify that the WildFire appliance software version you
want to install is available.
admin@WF-500(passive-controller)> request
system software check
Download the PAN-OS 10.2.2 software version to the WildFire
appliance.
You cannot skip any major release version when upgrading
the WildFire appliance. For example, if you want to upgrade from
PAN-OS 6.1 to PAN-OS 7.1, you must first download and install PAN-OS
7.0. The examples in this procedure demonstrate how to upgrade to
PAN-OS 10.2.2. Replace 10.2.2 with the appropriate target release
for your upgrade.
Download the WildFire appliance software image file
to be installed to a computer running SCP server software.
Import the software image from the SCP server:
admin@WF-500> scp import software from
<username@ip_address>/<folder_name>/<imagefile_name>
For
example:
admin@WF-500> scp import software
from user1@10.0.3.4:/tmp/WildFire_m-10.2.2
To check the status of the download, use the following
command:
admin@WF-500> show jobs all
Confirm that all services are running.
admin@WF-500(passive-controller)> show
system software status
Install the 10.2.2 software version.
admin@WF-500(passive-controller)> request
system software install version 10.2.2
Complete the software upgrade.
Confirm that the upgrade is complete. Run
the following command and look for the job type Install and
status FIN:
admin@WF-500(passive-controller)> show
jobs all
Enqueued Dequeued ID Type Status Result Completed
----------------------------------------------------
14:53:15 14:53:15 5 Install FIN OK 14:53:19
The upgrade
process could take 10 minutes or over an hour, depending on the
number of samples stored on the WildFire appliance.
Repeat steps 1-10 for each WildFire worker node in the
cluster.
(Optional) View the status of the reboot tasks on the
WildFire controller node.
On the WildFire cluster controller, run the following command
and look for the job type Install and Status FIN:
admin@WF-500(active-controller)> show
cluster task pending
Check that the WildFire appliance is ready to resume
sample analysis.
Verify that the sw-version field shows the
upgraded release version:
admin@WF-500(passive-controller)> show
system info | match sw-version
Confirm that all processes are running:
admin@WF-500(passive-controller)> show
system software status
Confirm that the auto-commit (AutoCom)
job is complete:
admin@WF-500(passive-controller)> show
jobs all
Confirm that data migration has successfully completed.
Run show cluster data-migration-status to view
the progress of the database merge. After the data merge is complete,
the completion timestamp displays:
100% completed on Mon Sep 9 21:44:48 PDT 2019
The
duration of a data merge depends on the amount of data stored on
the WildFire appliance. Be sure to allot at least several hours
for recovery as the data merge can be a lengthy process.
