Downgrade from Panorama 11.0
Table of Contents
11.0
Expand all | Collapse all
-
-
- Upgrade Panorama with an Internet Connection
- Upgrade Panorama Without an Internet Connection
- Install Content Updates Automatically for Panorama without an Internet Connection
- Upgrade Panorama in an HA Configuration
- Migrate Panorama Logs to the New Log Format
- Upgrade Panorama for Increased Device Management Capacity
- Upgrade Panorama and Managed Devices in FIPS-CC Mode
- Downgrade from Panorama 11.0
- Troubleshoot Your Panorama Upgrade
-
- What Updates Can Panorama Push to Other Devices?
- Schedule a Content Update Using Panorama
- Panorama, Log Collector, Firewall, and WildFire Version Compatibility
- Upgrade Log Collectors When Panorama Is Internet-Connected
- Upgrade Log Collectors When Panorama Is Not Internet-Connected
- Upgrade a WildFire Cluster from Panorama with an Internet Connection
- Upgrade a WildFire Cluster from Panorama without an Internet Connection
- Upgrade Firewalls When Panorama Is Internet-Connected
- Upgrade Firewalls When Panorama Is Not Internet-Connected
- Upgrade a ZTP Firewall
- Revert Content Updates from Panorama
-
Downgrade from Panorama 11.0
Procedure on how to downgrade from Panorama 11.0 to Panorama 10.2.
PAN-OS® 11.0 introduces advanced threat prevention support for Zero-day exploit prevention that
leverages inline deep learning, simplified software upgrade and downgrade for
Panorama and managed devices to reduce the operational burden of upgrading managed
devices across multiple PAN-OS releases, proactive Best Practice Assessment (BPA)
using AIOps to further eliminate exposure from a compromised security posture,
on-premises Web Proxy to help transition to the cloud without sacrificing security
or efficiency, firewall support for a stateful DHCPv6 Client to obtain IPv6
addresses, enhanced visibility for user context for the Cloud Identity Engine (CIE),
TLSv1.3 support for management access, and enhanced IoT security policy rule
recommendations to make it easier to scale and manage policy rule recommendations.
Use the following workflow to downgrade firewalls before you downgrade Log
Collectors and Panorama running a Panorama 11.0 release to an earlier feature
release. This procedure works both for Panorama when managing a local Log Collector
and for Panorama when managing one or more Dedicated Log Collectors.
To downgrade from PAN-OS 11.0 to an earlier PAN-OS release, you must download and install the
preferred PAN-OS 10.2 or later PAN-OS 10.2 release before you can continue on
your downgrade path to your target PAN-OS release. Downgrade from PAN-OS 11.0
fails if you attempt to downgrade to PAN-OS 10.1 or earlier PAN-OS release.
Review the Palo Alto Networks Compatibility Matrix to confirm
that the firewalls and appliances you intend to downgrade are compatible with
the PAN-OS release to which you intend to downgrade. For the firewalls and
appliances that you can downgrade, you should also review the Upgrade/Downgrade Considerations to ensure that you account for
all features and configuration settings that will be different or unavailable
after you downgrade.
- Save a backup of the configuration files for Panorama and managed devices.
- Export Panorama and device configuration snapshot().PanoramaSetupOperations
- Save the exported .tgz file to a location external to Panorama, Log Collectors, and firewalls. You can use this backup to restore the configuration if you experience problems that cause you to start over.
- If you have configured authentication for a Dedicated Log Collector and removed theadminadministrator, configure and push a newadminuser to your Dedicated Log Collectors.Dedicated Log Collectors must have theadminuser configured in order to downgrade to PAN-OS 9.1 and earlier releases.
- SelectandPanoramaPluginsDownloadthe plugin version supported on PAN-OS 10.2 for all plugins currently installed on Panorama.See the Panorama Plugins Compatibility Matrix for the Panorama plugin version supported on PAN-OS 10.2 and earlier releases.This is required to successfully downgrade Panorama from PAN-OS 11.0 to PAN-OS 10.2 and earlier releases. The downloaded plugin version is automatically installed during downgrade to PAN-OS 10.2. Downgrade to PAN-OS 10.2 is blocked if the supported plugin version is not downloaded.(ZTP plugin only) To successfully downgrade Panorama to PAN-OS 10.2, you must uninstall the ZTP plugin before you begin the downgrade process. After successful downgrade to PAN-OS 10.2, you must reinstall the ZTP plugin on Panorama.
- Downgrade each firewall running a PAN-OS 11.0 release.Downgrading from PAN-OS 11.0 to a previous feature release requires that you first downgrade to the preferred PAN-OS 10.2 release or later PAN-OS 10.2 release. After successfully downgrading to the preferred PAN-OS 10.2 or later PAN-OS 10.2 release, you can continue downgrading to your target PAN-OS version.If downgrading more than one firewall, streamline the process by having each firewall-specific PAN-OS 10.2 image downloaded to Panorama before you start downgrading. For example, to downgrade your PA-220 firewall to PAN-OS 10.2, download thePanOS_220-10.2.0orPanOS_3000-10.2.0images.Panorama requires that all firewalls are running the same or an earlier PAN-OS release. So before you downgrade Panorama, use and repeat the appropriate tasks below according to your environment to downgrade all managed firewalls as needed:
- Check Nowfor available images ().PanoramaDevice DeploymentSoftware(PAN-OS 11.0.5 and later 11.0 releases) By default, the preferred releases and the corresponding base releases are displayed. To view the preferred releases only, disable (clear) theBase Releasescheckbox. Similarly, to view the base releases only, disable (clear) thePreferred Releasescheckbox.
- Locate the PAN-OS 10.2 image for each model or series of firewalls you intend to downgrade. If the image is not already downloaded, thenDownloadit.
Non-HA FirewallInstall(Action column) the appropriate PAN-OS 10.2 version, select all the firewalls you intend to downgrade, selectReboot device after install, and clickOK.Active/Active HA Firewalls- ClickInstall, disable (clear)Group HA Peers, select either of the HA peers, selectReboot device after install, and clickOK. Wait for the firewall to finish rebooting before you proceed.
- ClickInstall, disable (clear)Group HA Peers, select the HA peer that you didn’t update in the previous step, selectReboot device after install, and clickOK.
Active/Passive HA FirewallsIn this example, the active firewall is named fw1 and the passive firewall is named fw2:- Install(Action column) the appropriate update, disable (clear)Group HA Peers, select fw2, selectReboot device after install, and clickOK.
- After fw2 finishes rebooting, verify fw1 (widget) is still the active peer and that fw2 is still the passive peer (the Local firewall state isDashboardHigh Availabilityactiveand the Peer—fw2—ispassive).
- Access fw1 andSuspend local device().DeviceHigh AvailabilityOperational Commands
- Access fw2 () and verify that the Local firewall state isDashboardHigh Availabilityactiveand the Peer firewall—fw1—issuspended.
- Access Panorama, select,PanoramaDevice DeploymentSoftwareInstall(Action column) the appropriate update, disable (clear)Group HA Peers, select fw1, selectReboot device after install, and clickOK. Wait for fw1 to finish rebooting before you proceed.
- Access fw1 (widget) and verify that the Local firewall state isDashboardHigh Availabilitypassiveand the Peer—fw2—isactive.If you enabled preemption in the Election settings (), then fw1 will be reinstated as the active peer after reboot.DeviceHigh AvailabilityGeneral
- Downgrade each Log Collector running Panorama 11.0.Downgrading from PAN-OS 11.0 to a previous feature release requires that you first downgrade to the preferred PAN-OS 10.2 or later PAN-OS 10.2 release. After successfully downgrading to the preferred PAN-OS 10.2 or later PAN-OS 10.2 release, you can continue downgrading to your target PAN-OS version.
- Check Nowfor available images ().PanoramaDevice DeploymentSoftware(PAN-OS 11.0.5 and later 11.0 releases) By default, the preferred releases and the corresponding base releases are displayed. To view the preferred releases only, disable (clear) theBase Releasescheckbox. Similarly, to view the base releases only, disable (clear) thePreferred Releasescheckbox.
- Locate the Panorama 10.2 image. If the image is not already downloaded, thenDownloadit (Action column).
- After the download is complete,Installthe image on each Log Collector running Panorama 10.2. SelectReboot device after installto automatically reboot the device when the upgrade is complete.
- Downgrade Panorama.Downgrading from PAN-OS 11.0 to a previous feature release requires that you first downgrade to the preferred PAN-OS 10.2 or later PAN-OS 10.2 release. After successfully downgrading to the preferred PAN-OS 10.2 or later PAN-OS 10.2 release, you can continue downgrading to your target PAN-OS version.
- SelectandPanoramaSoftwareCheck Nowfor available images.(PAN-OS 11.0.5 and later 11.0 releases) By default, the preferred releases and the corresponding base releases are displayed. To view the preferred releases only, disable (clear) theBase Releasescheckbox. Similarly, to view the base releases only, disable (clear) thePreferred Releasescheckbox.
- Locate the Panorama 10.2 image. If the image is not already downloaded, thenDownloadit.
- After the download is complete,Installthe image on Panorama.
- Reboot Panorama as follows:
- If you are prompted to reboot, clickYes. If you see aCMS Loginprompt, press Enter without typing the username or password. When the Panorama login prompt appears, enter the username and password you set during initial configuration.
- If you are not prompted to reboot, selectand clickPanoramaSetupOperationsReboot Panorama(Device Operations).
- (ZTP plugin only) Re-install the ZTP plugin.
- Selectand check (enable)PanoramaZero Touch ProvisioningZTP.
- (Enterprise DLP only) Edit the Enterprise DLP data filtering settings to reduce theMax File Sizeto 20MB or less.This is required when downgrading from Panorama plugin for Enterprise DLP 4.0.1 or later release. Large file size inspection is supported on Enterprise DLP 4.0.1 and later releases.
- (Enterprise DLP only) Synchronize the Enterprise DLP data filtering profiles on Panorama with the DLP cloud service.This is required when downgrading Panorama from PAN-OS 11.0.2 and Enterprise DLP plugin 4.0.1 to PAN-OS 11.0.1 or earlier 11.0 release and Enterprise DLP plugin 4.0.0.
- Log in to the Panorama CLI.
- Push the Enterprise DLP configuration from Panorama to the DLP cloud service.admin>request plugins dlp push-dlp-configReset the Enterprise DLP plugin.admin>request plugins dlp resetCommit on Panorama and push to managed firewalls using Enterprise DLP.
- SelectandCommitCommit to PanoramaCommit.
- SelectandCommitPush to DevicesEdit Selections.
- SelectDevice GroupsandInclude Device and Network Templates.
- ClickOK.
- Pushyour configuration changes to your managed firewalls that are using Enterprise DLP.