Upgrade Standalone Panorama Leveraging SD-WAN Plugin
Table of Contents
11.0
Expand all | Collapse all
-
-
- Upgrade Panorama with an Internet Connection
- Upgrade Panorama Without an Internet Connection
- Install Content Updates Automatically for Panorama without an Internet Connection
- Upgrade Panorama in an HA Configuration
- Migrate Panorama Logs to the New Log Format
- Upgrade Panorama for Increased Device Management Capacity
- Upgrade Panorama and Managed Devices in FIPS-CC Mode
- Downgrade from Panorama 11.0
- Troubleshoot Your Panorama Upgrade
-
- What Updates Can Panorama Push to Other Devices?
- Schedule a Content Update Using Panorama
- Panorama, Log Collector, Firewall, and WildFire Version Compatibility
- Upgrade Log Collectors When Panorama Is Internet-Connected
- Upgrade Log Collectors When Panorama Is Not Internet-Connected
- Upgrade a WildFire Cluster from Panorama with an Internet Connection
- Upgrade a WildFire Cluster from Panorama without an Internet Connection
- Upgrade Firewalls When Panorama Is Internet-Connected
- Upgrade Firewalls When Panorama Is Not Internet-Connected
- Upgrade a ZTP Firewall
- Revert Content Updates from Panorama
-
Upgrade Standalone Panorama Leveraging SD-WAN Plugin
Upgrade path and step-by-step procedure for the SD-WAN plugin version that your
standalone Panorama management server is running.
Where Can I Use This? | What Do I Need? |
---|---|
|
|
Complete the Prerequisites before proceeding with the upgrade
procedure.
Follow the upgrade path based on the SD-WAN plugin version that your
Panorama management server is running.
Panorama Running SD-WAN Plugin Version | Follow the Steps |
---|
Standalone Panorama: Upgrade SD-WAN Plugin 1.0.4 to 2.2.6 Release
It's recommended to always ensure that the Panorama software version is higher
than the PAN-OS version. For example, if your Panorama version is 10.1.9, then
your PAN-OS version can be any of the earlier PAN-OS 10.1.9 releases.
Read the important considerations for
upgrading Panorama before you start the upgrade process.
- Download and install Panorama software version 10.0.7-h3.From Panorama 10.0.7-h3, download, and install the latest Panorama 10.1 release.Download and install the SD-WAN plugin version 2.2.6 on Panorama.(In configuration mode) Forcefully commit the changes from the active Panorama.After completing the SD-WAN plugin upgrade, you must perform a commit force through the CLI (configuration mode) on the Palo Alto Networks device. If you perform commit all instead of commit force, then you will lose all the SD-WAN configurations on that device.Check the following after upgrading the standalone Panorama.
- Push to devices from Panorama.
- Select PanoramaManaged DevicesSummary and verify if the device group and templates are in synchronization on both active and passive Panorama under the devices summary page.
- Verify if the SD-WAN configurations such as, Tunnel, BGP, Key ID,
and traffic are as expected.After successful upgrade of the Panorama HA pair, the Key ID, PSK, IP cache, IPSec tunnel cache, and subnet cache will be refreshed which will not affect the functionalities of SD-WAN.
Once the Panorama upgrade is successful, if needed, all the connected devices can be upgraded one-by-one starting with the branch pairs/standalone followed by the hub pairs/standalone. It's recommended to check the SD-WAN configuration and functionality after each upgrade.After the upgrade is complete, note the changes after the upgrade.Standalone Panorama: Upgrade SD-WAN Plugin 2.1.x to 2.2.6 Release
It's recommended to always ensure that the Panorama software version is higher than the PAN-OS version. For example, if your Panorama version is 10.1.9, then your PAN-OS version can be any of the earlier PAN-OS 10.1.9 releases.Read the important considerations for upgrading Panorama before you start the upgrade process.- Download and install the latest Panorama 10.1 release.Download and install the SD-WAN plugin version 2.2.6 on Panorama.(In configuration mode) Forcefully commit the changes from the active Panorama.After completing the SD-WAN plugin upgrade, you must perform a commit force through the CLI (configuration mode) on the Palo Alto Networks device. If you perform commit all instead of commit force, then you will lose all the SD-WAN configurations on that device.Check the following after upgrading the standalone Panorama.
- Push to devices from Panorama.
- Select PanoramaManaged DevicesSummary and verify if the device group and templates are in synchronization on both active and passive Panorama under the devices summary page.
- Verify if the SD-WAN configurations such as, Tunnel, BGP, Key ID,
and traffic are as expected.After successful upgrade of the Panorama HA pair, the Key ID, PSK, IP cache, IPSec tunnel cache, and subnet cache will be refreshed which will not affect the functionalities of SD-WAN.
Once the Panorama upgrade is successful, if needed, all the connected devices can be upgraded one-by-one starting with the branch pairs/standalone followed by the hub pairs/standalone. It's recommended to check the SD-WAN configuration and functionality after each upgrade.After the upgrade is complete, note the changes after the upgrade.Standalone Panorama: Upgrade SD-WAN Plugin 2.2.6 to 3.0.7 Release
It's recommended to always ensure that the Panorama software version is higher than the PAN-OS version. For example, if your Panorama version is 10.1.9, then your PAN-OS version can be any of the earlier PAN-OS 10.1.9 releases.Read the important considerations for upgrading Panorama before you start the upgrade process.- Download and install the latest Panorama 10.1 release.Download and install the SD-WAN plugin version 2.2.6 on Panorama.(In configuration mode) Forcefully commit the changes from the active Panorama.After completing the SD-WAN plugin upgrade, you must perform a commit force through the CLI (configuration mode) on the Palo Alto Networks device. If you perform commit all instead of commit force, then you will lose all the SD-WAN configurations on that device.Check the following after upgrading the standalone Panorama.
- Push to devices from Panorama.
- Select PanoramaManaged DevicesSummary and verify if the device group and templates are in synchronization on both active and passive Panorama under the devices summary page.
- Verify if the SD-WAN configurations such as, Tunnel, BGP, Key ID,
and traffic are as expected.After successful upgrade of the Panorama HA pair, the Key ID, PSK, IP cache, IPSec tunnel cache, and subnet cache will be refreshed which will not affect the functionalities of SD-WAN.
Once the Panorama upgrade is successful, if needed, all the connected devices can be upgraded one-by-one starting with the branch pairs/standalone followed by the hub pairs/standalone. It's recommended to check the SD-WAN configuration and functionality after each upgrade.After the upgrade is complete, note the changes after the upgrade.