Upgrade a ZTP Firewall
Table of Contents
11.0
Expand all | Collapse all
-
-
- Upgrade Panorama with an Internet Connection
- Upgrade Panorama Without an Internet Connection
- Install Content Updates Automatically for Panorama without an Internet Connection
- Upgrade Panorama in an HA Configuration
- Migrate Panorama Logs to the New Log Format
- Upgrade Panorama for Increased Device Management Capacity
- Upgrade Panorama and Managed Devices in FIPS-CC Mode
- Downgrade from Panorama 11.0
- Troubleshoot Your Panorama Upgrade
-
- What Updates Can Panorama Push to Other Devices?
- Schedule a Content Update Using Panorama
- Panorama, Log Collector, Firewall, and WildFire Version Compatibility
- Upgrade Log Collectors When Panorama Is Internet-Connected
- Upgrade Log Collectors When Panorama Is Not Internet-Connected
- Upgrade a WildFire Cluster from Panorama with an Internet Connection
- Upgrade a WildFire Cluster from Panorama without an Internet Connection
- Upgrade Firewalls When Panorama Is Internet-Connected
- Upgrade Firewalls When Panorama Is Not Internet-Connected
- Upgrade a ZTP Firewall
- Revert Content Updates from Panorama
-
Upgrade a ZTP Firewall
Automatically upgrade your a ZTP firewall.
After you successfully add a ZTP firewall to the
Panorama™ management server, configure the target PAN-OS version
of the ZTP firewall. Panorama checks whether PAN-OS version installed
on the ZTP firewall is greater than or equal to the configured target
PAN-OS version after it successfully connects to Panorama for the
first time. If the PAN-OS version installed on the ZTP firewall
is less than the target PAN-OS version, then the ZTP firewall enters
an upgrade cycle until target PAN-OS version is installed.
- Log in to the Panorama Web Interface as an admin user.Add a ZTP Firewall to Panorama.Select PanoramaDevice DeploymentUpdates and Check Now for the latest PAN-OS releases.Select PanoramaManaged DevicesSummary and select one or more ZTP firewalls.Reassociate the selected ZTP firewall(s).Check (enable) Auto Push on 1st Connect.In the To SW Version column, select the target PAN-OS version for the ZTP firewall.Click OK to save your configuration changes.Select Commit and Commit to Panorama.Power on the ZTP firewall.When the ZTP firewall connects to Panorama for the first time, it automatically upgrades to the PAN-OS version you selected.
- Panorama running PAN-OS 11.0.0—If you are upgrading managed firewalls across PAN-OS major or maintenance releases, the intermediary PAN-OS releases on your upgrade path are installed first before the target PAN-OS release is installed.For example, you configured the target To SW Version for the managed firewall as PAN-OS 11.0.0 and the firewall is running PAN-OS 10.1. On first connection to Panorama, PAN-OS 10.2.0 is installed on the managed firewall first. After PAN-OS 10.2.0 successfully installs, the firewall is automatically upgraded to the target PAN-OS 11.0.0 release.
- Panorama running PAN-OS 11.0.1 and later releases—If you are upgrading managed firewalls across PAN-OS major or maintenance releases, the intermediary PAN-OS major releases on your upgrade path are installed and the base PAN-OS major release is downloaded before the target PAN-OS maintenance release is installed.For example, you configured the target To SW Version for the managed firewall as PAN-OS 11.0.1 and the firewall is running PAN-OS 10.0. On first connection to Panorama, PAN-OS 10.1.0 and PAN-OS 10.2.0 are installed on the managed firewall. After the managed firewall reboots, PAN-OS 11.0.0 is downloaded and then the firewall automatically installs to the target PAN-OS 11.0.1 release.
Verify the ZTP firewall software upgrade.- Log in to the Panorama Web Interface.Select PanoramaManaged DevicesSummary and navigate to the ZTP firewall(s).Verify the Software Version column displays the correct target PAN-OS release.For all future PAN-OS upgrades, see Upgrade the Firewall to PAN-OS 11.0 from Panorama.