Upgrade Firewalls When Panorama Is Internet-Connected
Table of Contents
10.1
Expand all | Collapse all
-
-
- Upgrade Panorama with an Internet Connection
- Upgrade Panorama Without an Internet Connection
- Install Content Updates Automatically for Panorama without an Internet Connection
- Upgrade Panorama in an HA Configuration
- Migrate Panorama Logs to the New Log Format
- Upgrade Panorama for Increased Device Management Capacity
- Downgrade from Panorama 10.1
- Troubleshoot Your Panorama Upgrade
-
- What Updates Can Panorama Push to Other Devices?
- Schedule a Content Update Using Panorama
- Panorama, Log Collector, Firewall, and WildFire Version Compatibility
- Upgrade Log Collectors When Panorama Is Internet-Connected
- Upgrade Log Collectors When Panorama Is Not Internet-Connected
- Upgrade a WildFire Cluster from Panorama with an Internet Connection
- Upgrade a WildFire Cluster from Panorama without an Internet Connection
- Upgrade Firewalls When Panorama Is Internet-Connected
- Upgrade Firewalls When Panorama Is Not Internet-Connected
- Upgrade a ZTP Firewall
- Revert Content Updates from Panorama
-
Upgrade Firewalls When Panorama Is Internet-Connected
Procedure to upgrade managed firewalls when Panorama
is Internet connected.
Review the PAN-OS 10.1 Release Notes and
then use the following procedure to upgrade firewalls that you manage
with Panorama. This procedure applies to standalone firewalls and
firewalls deployed in a high availability (HA) configuration.
When upgrading HA firewalls across multiple feature PAN-OS releases, you must upgrade
each HA peer to the same feature PAN-OS release on your upgrade path before
continuing. For example, you are upgrading HA peers from PAN-OS 9.1 to PAN-OS 10.1.
You must upgrade both HA peers to PAN-OS 10.0 before you can continue upgrading to
the target PAN-OS 10.1 release. When HA peers are two or more feature releases
apart, the firewall with the older release installed enters a
suspended state with the message Peer
version too old.
If Panorama is unable to connect directly
to the updates server, follow the Upgrade
Firewalls When Panorama Is Not Internet-Connected procedure
so that you can manually download images to Panorama and then distribute
the images to firewalls.
Before you can upgrade firewalls
from Panorama, you must:
- Make sure Panorama is running the same or a later PAN-OS version than you are upgrading to. You must upgrade Panorama and its Log Collectors to 10.1 before upgrading the managed firewalls to this version. In addition, when upgrading Log Collectors to 10.1, you must upgrade all Log Collectors at the same time due to changes in the logging infrastructure.
- Ensure that firewalls are connected to a reliable power source. A loss of power during an upgrade can make a firewall unusable.
- Decide whether to stay in Legacy mode if the Panorama virtual appliance is in Legacy mode on upgrade to PAN-OS 10.1. Legacy mode is not supported for a new Panorama virtual appliance deployment running PAN-OS 9.1 or later release. If you upgrade the Panorama virtual appliance from PAN-OS 9.0 or earlier release to PAN-OS 10.1, Palo Alto Networks recommends reviewing the Setup Prerequisites for the Panorama Virtual Appliance and changing to Panorama mode or Management Only mode based on your needs.If you want to keep the Panorama virtual appliance in Legacy mode, increase CPUs and memory allocated to the Panorama virtual appliance to a minimum 8 CPUs and 16GB memory to successfully upgrade to PAN-OS 10.1. See the Setup Prerequisites for the Panorama Virtual Appliance for more information.
- Log in to the Panorama web interface.
- Save
a backup of the current configuration file on each managed firewall
you plan to upgrade.Although the firewall automatically creates a configuration backup, it is a best practice to create and externally store a backup before you upgrade.
- From the Panorama web interface, select PanoramaSetupOperations and click Export Panorama and devices config bundle to generate and export the latest configuration backup of Panorama and of each managed appliance.
- Save the exported file to a location external to the firewall. You can use this backup to restore the configuration if you have problems with the upgrade.
- Update the content release version on the firewalls you
plan to upgrade.Refer to the Release Notes for the minimum content release version required for PAN-OS 10.1. Make sure to follow the Best Practices for Applications and Threats Content Updates when deploying content updates to Panorama and managed firewalls.
- Select PanoramaDevice DeploymentDynamic Updates and Check Now for the latest updates. If an update is available, the Action column displays a Download link.
- If not already installed, Download the latest content release version.
- Click Install, select the firewalls
on which you want to install the update, and click OK.
If you are upgrading HA firewalls, you must update content on both
peers.By default, you can upload a maximum of two software or content updates of each type to a Panorama appliance and if you download a third update of the same type, Panorama will delete the update for the earliest version of that type. If you need to upload more than two software updates or content updates of a single type, use the setmax-num-images count <number> CLI command to increase the maximum.
- Determine the Upgrade Path to PAN-OS 10.1.You cannot skip installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 10.1.0.Review the PAN-OS Upgrade Checklist, the known issues and changes to default behavior in the Release Notes and upgrade/downgrade considerations for each release through which you pass as part of your upgrade path.If upgrading more than one firewall, streamline the process by determining upgrade paths for all firewalls before you start downloading images.
- (Best Practices) If you are leveraging Cortex Data Lake (CDL), install the device certificate. The firewall automatically switches to using the device certificate for authentication with CDL ingestion and query endpoints on upgrade to PAN-OS 10.1.If you do not install the device certificate prior to upgrade to PAN-OS 10.1, the firewall continues to use the existing logging service certificates for authentication.
- (HA firewall upgrades only) If you will be upgrading
firewalls that are part of an HA pair, disable preemption. You need
only disable this setting on one firewall in each HA pair.
- Log in to the firewall web interface of one of the firewall HA peers.
- Select DeviceHigh Availability and edit the Election Settings.
- If enabled, disable (clear) the Preemptive setting and click OK.
- Commit your change. Make sure the commit is successful before you proceed with the upgrade.
- (HA firewall upgrades only) Suspend the primary HA peer to force a
failover.(Active/passive firewalls) For firewalls in an active/passive HA configuration, suspend and upgrade the active HA peer first.(Active/active firewalls) For firewalls in an active/active HA configuration, suspend and upgrade the active-primary HA peer first.
- Log in to the firewall web interface of active primary firewall HA peer.
- Select DeviceHigh AvailabilityOperational Commands and Suspend local device for high availability.
- In the bottom-right corner, verify that the state is
suspended.The resulting failover should cause the secondary passive HA peer to transition to active state.The resulting failover verifies that HA failover is functioning properly before you upgrade.
- Download
the target PAN-OS 10.1.0 release image.
- Select PanoramaDevice DeploymentSoftware and Check Now for the latest release versions.
- Download the firewall-specific
file (or files) for the release version to which you are upgrading.
You must download a separate installation file for each firewall model
(or firewall series) that you intend to upgrade.For example, to upgrade your PA-220 and PA-5250 firewalls to PAN-OS 10.1.0, download the PanOS_220-10.1.0, PanOS_3000-10.1.0, and PanOS_5200-10.1.0 images. After you successfully download an image, the Action column changes to Install for that image.
- Install
the PAN-OS 10.1 software update on the firewalls.(SD-WAN only) To preserve an accurate status for your SD-WAN links, you must upgrade your hub firewalls to PAN-OS 10.1 before you upgrade your branch firewalls. Upgrading branch firewalls before hub firewalls may result in incorrect monitoring data (PanoramaSD-WANMonitoring) and for SD-WAN links to erroneously display as down.
- Click Install in the Action column that corresponds to the firewall models you want to upgrade. For example, if you want to upgrade your PA-220 firewalls, click Install in the row that corresponds to PanOS_220-10.1.0.
- In the Deploy Software file dialog, select all firewalls that you want
to upgrade. (HA firewall upgrades only) To reduce downtime, select only one peer in each HA pair. For active/passive pairs, select the passive peer; for active/active pairs, select the active-secondary peer.
- (HA firewall upgrades only) Make sure Group HA Peers is not selected.
- Select Reboot device after install.
- To begin the upgrade, click OK.
- After the installation completes successfully, reboot
using one of the following methods:
- If you are prompted to reboot, click Yes.
- If you are not prompted to reboot, select DeviceSetupOperations and Reboot Device.
- After the firewalls finish rebooting, select PanoramaManaged Devices and verify the Software Version is 10.1.0 for the firewalls you upgraded. Also verify that the HA status of any passive firewalls you upgraded is still passive.
- (HA firewall upgrades only) Restore HA functionality to the primary HA
peer.
- Log in to the firewall web interface of suspended primary firewall HA peer.
- Select DeviceHigh AvailabilityOperational Commands and Make local device functional for high availability.
- In the bottom-right corner, verify that the state is Passive. For firewalls in an active/active configuration, verify that the state is Active.
- Wait for the HA peer running configuration to synchronize.In the Dashboard, monitor the Running Config status in the High Availability widget.
- (HA firewall upgrades only) Suspend the secondary HA peer to force a
failover back to the primary HA peer.
- Log in to the firewall web interface of active secondary firewall HA peer.
- Select DeviceHigh AvailabilityOperational Commands and Suspend local device for high availability.
- In the bottom-right corner, verify that the state is
suspended.The resulting failover should cause the primary passive HA peer to transition to active state.The resulting failover verifies that HA failover is functioning properly before you upgrade.
- (HA firewall upgrades only) Upgrade the second HA peer in each HA
pair.
- In the Panorama web interface, select PanoramaDevice DeploymentSoftware.
- Click Install in the Action column that corresponds to the firewall models of the HA pairs you are upgrading.
- In the Deploy Software file dialog, select all firewalls that you want to upgrade. This time, select only the peers of the HA firewalls you just upgraded.
- Make sure Group HA Peers is not selected.
- Select Reboot device after install.
- To begin the upgrade, click OK.
- After the installation completes successfully, reboot using one of the
following methods:
-
If you are prompted to reboot, click Yes.
-
If you are not prompted to reboot, select DeviceSetupOperations and Reboot Device.
-
- (HA firewall upgrades only) Restore HA functionality to the secondary
HA peer.
- Log in to the firewall web interface of suspended secondary firewall HA peer.
- Select DeviceHigh AvailabilityOperational Commands and Make local device functional for high availability.
- In the bottom-right corner, verify that the state is Passive. For firewalls in an active/active configuration, verify that the state is Active.
- Wait for the HA peer running configuration to synchronize.In the Dashboard, monitor the Running Config status in the High Availability widget.
- Verify the software and content release version running
on each managed firewall.
- On Panorama, select PanoramaManaged Devices.
- Locate the firewalls and review the content and software
versions in the table.For HA firewalls, you can also verify that the HA Status of each peer is as expected.
- (HA firewall upgrades only)If you disabled preemption on one of your HA firewalls before you upgraded, then edit the Election Settings (DeviceHigh Availability) and re-enable the Preemptive setting for that firewall and then Commit the change.