: Upgrade Standalone Panorama Leveraging SD-WAN Plugin
Focus
Focus

Upgrade Standalone Panorama Leveraging SD-WAN Plugin

Table of Contents

Upgrade Standalone Panorama Leveraging SD-WAN Plugin

Upgrade path and step-by-step procedure for the SD-WAN plugin version that your standalone Panorama management server is running.
Where Can I Use This?What Do I Need?
  • PAN-OS
  • SD-WAN
  • SD-WAN plugin license
Complete the Prerequisites before proceeding with the upgrade procedure.
Follow the upgrade path based on the SD-WAN plugin version that your Panorama management server is running.
Panorama Running SD-WAN Plugin VersionFollow the Steps
1.0.x
2.1.x
2.2.6

Standalone Panorama: Upgrade SD-WAN Plugin 1.0.4 to 2.2.6 Release

It's recommended to always ensure that the Panorama software version is higher than the PAN-OS version. For example, if your Panorama version is 10.1.9, then your PAN-OS version can be any of the earlier PAN-OS 10.1.9 releases.
Read the important considerations for upgrading Panorama before you start the upgrade process.
  1. Download and install Panorama software version 10.0.7-h3.
  2. From Panorama 10.0.7-h3, download, and install the latest Panorama 10.1 release.
  3. Download and install the SD-WAN plugin version 2.2.6 on Panorama.
  4. (In configuration mode) Forcefully commit the changes from the active Panorama.
    After completing the SD-WAN plugin upgrade, you must perform a commit force through the CLI (configuration mode) on the Palo Alto Networks device. If you perform commit all instead of commit force, then you will lose all the SD-WAN configurations on that device.
  5. Check the following after upgrading the standalone Panorama.
    1. Push to devices from Panorama.
    2. Select PanoramaManaged DevicesSummary and verify if the device group and templates are in synchronization on both active and passive Panorama under the devices summary page.
    3. Verify if the SD-WAN configurations such as, Tunnel, BGP, Key ID, and traffic are as expected.
      After successful upgrade of the Panorama HA pair, the Key ID, PSK, IP cache, IPSec tunnel cache, and subnet cache will be refreshed which will not affect the functionalities of SD-WAN.
  6. Once the Panorama upgrade is successful, if needed, all the connected devices can be upgraded one-by-one starting with the branch pairs/standalone followed by the hub pairs/standalone. It's recommended to check the SD-WAN configuration and functionality after each upgrade.
  7. After the upgrade is complete, note the changes after the upgrade.

Standalone Panorama: Upgrade SD-WAN Plugin 2.1.x to 2.2.6 Release

It's recommended to always ensure that the Panorama software version is higher than the PAN-OS version. For example, if your Panorama version is 10.1.9, then your PAN-OS version can be any of the earlier PAN-OS 10.1.9 releases.
Read the important considerations for upgrading Panorama before you start the upgrade process.
  1. Download and install the latest Panorama 10.1 release.
  2. Download and install the SD-WAN plugin version 2.2.6 on Panorama.
  3. (In configuration mode) Forcefully commit the changes from the active Panorama.
    After completing the SD-WAN plugin upgrade, you must perform a commit force through the CLI (configuration mode) on the Palo Alto Networks device. If you perform commit all instead of commit force, then you will lose all the SD-WAN configurations on that device.
  4. Check the following after upgrading the standalone Panorama.
    1. Push to devices from Panorama.
    2. Select PanoramaManaged DevicesSummary and verify if the device group and templates are in synchronization on both active and passive Panorama under the devices summary page.
    3. Verify if the SD-WAN configurations such as, Tunnel, BGP, Key ID, and traffic are as expected.
      After successful upgrade of the Panorama HA pair, the Key ID, PSK, IP cache, IPSec tunnel cache, and subnet cache will be refreshed which will not affect the functionalities of SD-WAN.
  5. Once the Panorama upgrade is successful, if needed, all the connected devices can be upgraded one-by-one starting with the branch pairs/standalone followed by the hub pairs/standalone. It's recommended to check the SD-WAN configuration and functionality after each upgrade.
  6. After the upgrade is complete, note the changes after the upgrade.

Standalone Panorama: Upgrade SD-WAN Plugin 2.2.6 to 3.0.7 Release

It's recommended to always ensure that the Panorama software version is higher than the PAN-OS version. For example, if your Panorama version is 10.1.9, then your PAN-OS version can be any of the earlier PAN-OS 10.1.9 releases.
Read the important considerations for upgrading Panorama before you start the upgrade process.
  1. Download and install the latest Panorama 10.1 release.
  2. Download and install the SD-WAN plugin version 2.2.6 on Panorama.
  3. (In configuration mode) Forcefully commit the changes from the active Panorama.
    After completing the SD-WAN plugin upgrade, you must perform a commit force through the CLI (configuration mode) on the Palo Alto Networks device. If you perform commit all instead of commit force, then you will lose all the SD-WAN configurations on that device.
  4. Check the following after upgrading the standalone Panorama.
    1. Push to devices from Panorama.
    2. Select PanoramaManaged DevicesSummary and verify if the device group and templates are in synchronization on both active and passive Panorama under the devices summary page.
    3. Verify if the SD-WAN configurations such as, Tunnel, BGP, Key ID, and traffic are as expected.
      After successful upgrade of the Panorama HA pair, the Key ID, PSK, IP cache, IPSec tunnel cache, and subnet cache will be refreshed which will not affect the functionalities of SD-WAN.
  5. Once the Panorama upgrade is successful, if needed, all the connected devices can be upgraded one-by-one starting with the branch pairs/standalone followed by the hub pairs/standalone. It's recommended to check the SD-WAN configuration and functionality after each upgrade.
  6. After the upgrade is complete, note the changes after the upgrade.