Upgrade a Firewall to the Latest PAN-OS Version (API)
Table of Contents
10.0 (EoL)
Expand all | Collapse all
-
- Upgrade a Firewall to the Latest PAN-OS Version (API)
- Show and Manage GlobalProtect Users (API)
- Query a Firewall from Panorama (API)
- Upgrade PAN-OS on Multiple HA Firewalls through Panorama (API)
- Automatically Check for and Install Content Updates (API)
- Enforce Policy using External Dynamic Lists and AutoFocus Artifacts (API)
- Configure SAML 2.0 Authentication (API)
- Quarantine Compromised Devices (API)
- Manage Certificates (API)
-
- Asynchronous and Synchronous Requests to the PAN-OS XML API
- Run Operational Mode Commands (API)
- Apply User-ID Mapping and Populate Dynamic Groups (API)
- Get Version Info (API)
-
- PAN-OS REST API
- Access the PAN-OS REST API
- Resource Methods and Query Parameters (REST API)
- PAN-OS REST API Request and Response Structure
- PAN-OS REST API Error Codes
- Work With Objects (REST API)
- Create a Security Policy Rule (REST API)
- Work with Policy Rules on Panorama (REST API)
- Create a Tag (REST API)
- Configure a Security Zone (REST API)
- Configure an SD-WAN Interface (REST API)
- Create an SD-WAN Policy Pre Rule (REST API)
- Configure an Ethernet Interface (REST API)
- Update a Virtual Router (REST API)
- Work With Decryption (APIs)
End-of-Life (EoL)
Upgrade a Firewall to the Latest PAN-OS Version (API)
You can use the PAN-OS XML API to update your
firewall with the latest PAN-OS and Content Release versions.
Because
the PAN-OS XML API uses a tree of XML nodes, in your API request
you must specify the correct type and action along with the XPath Node Selection. See Explore
the API to learn how to construct XML requests.
- Download the latest content update.Use the following request to first download the latest content update:curl -X GET 'https://<firewall>/api/?type=op&cmd=<request><content><upgrade><download><latest/></download></upgrade></content></request>&key=<apikey>'If successful, the response contains a jobid that you can use to check on the status of your request.<response status="success" code="19"> <result> <msg> <line>Download job enqueued with jobid 2</line> </msg> <job>2</job> </result> </response>
- Check on the content download status.
Use the jobid to ensure that the content download completes successfully:curl -X GET 'https://<firewall>/api/?type=op&cmd=<show><jobs><id>2</id></jobs></show>&key=<apikey>'The response should include the following:<response status="success">…- Install the latest content update.
Use the following request to install the newly downloaded content:curl -X GET 'https://<firewall>/api/?type=op&cmd<request><content><upgrade><install> <version>latest</version></install></upgrade></content></request>key=<apikey>'If successful, the response contains a jobid that you can use to check on the status of your request.<response status="success" code="19"> <result> <msg> <line>Content install job enqueued with jobid 3</line> </msg> <job>3</job> </result> </response>- Check on the content installation status.
Use the jobid to ensure that the content installation completes successfully:curl -X GET 'https://<firewall>/api/?type=op&cmd=<show><jobs><id>3</id></jobs></show>&key=<apikey>'The response should include the following:<response status="success">…- Check for the latest PAN-OS software update.
After installing the latest Content Release update, check for the latest available PAN-OS software updates:curl -X GET 'https://<firewall>/api/?type=op&cmd=<request><system><software><check></check> </software></system></request>&key=<apikey>'In the response, the first entry is the latest version of PAN-OS:<response status="success"> <result> <sw-updates last-updated-at="2015/10/20 14:16:30"> <msg /> <versions> <version>7.1.0</version> <filename>PanOS_3000-7.1.0-c65</filename> <size>720</size> <size-kb>737504</size-kb> <released-on>2015/10/20 13:23:11</released-on> ...- Download the latest PAN-OS software update.
- In this case, the latest version is 7.1.0-c65,
so download that version:curl -X GET 'https://<firewall>/api/?type=op&cmd=<request><system><software><download><version>7.1.0-c65</version></download></software></system></request>&key=<apikey>'
- Use the jobid in the response to ensure that the system update download completes successfully:
curl -X GET 'https://<firewall>/api/?type=op&cmd=<show><jobs><id>318</id></jobs></show>&key=<apikey>'The response should include the following:<response status="success">…- Install the latest PAN-OS software update.
To install the latest system update, include the version in a software install request:curl -X GET 'https://<firewall>/api/?type=op&cmd=<request><system><software><install><version>7.1.0-c65</version></install></software></system></request>&key=<apikey>'- Check on the software installation status.
Use the jobid in the response to ensure that the system update installs successfully:curl -X GET 'https://<firewall>/api/?type=op&cmd=<show><jobs><id>320</id></jobs></show>&key=<apikey>'The response should include the following:<response status="success">…- Reboot the firewall.
After the system update installs successfully, trigger:curl -X GET 'https://<firewall>/api/?type=op&cmd=<request><restart><system></system></restart></request>&key=<apikey>' - Use the jobid in the response to ensure that the system update download completes successfully:
- Check on the content download status.