Downgrade from Panorama 11.0

Log in to the Panorama web interface.
Save a backup of the configuration files for Panorama and managed devices.
Export Panorama and device configuration snapshot
(
Panorama
Setup
Operations
).
Save the exported .tgz file to a location external to Panorama, Log Collectors, and firewalls. You can use this backup to restore the configuration if you experience problems that cause you to start over.
If you have configured authentication for a Dedicated Log Collector and removed the
admin
administrator, configure and push a new
admin
user to your Dedicated Log Collectors.
Dedicated Log Collectors must have the
admin
user configured in order to downgrade to PAN-OS 9.1 and earlier releases.
Select
Panorama
Plugins
and
Download
the plugin version supported on PAN-OS 10.2 for all plugins currently installed on Panorama.
See the Panorama Plugins Compatibility Matrix for the Panorama plugin version supported on PAN-OS 10.2 and earlier releases.
This is required to successfully downgrade Panorama from PAN-OS 11.0 to PAN-OS 10.2 and earlier releases. The downloaded plugin version is automatically installed during downgrade to PAN-OS 10.2. Downgrade to PAN-OS 10.2 is blocked if the supported plugin version is not downloaded.
(
ZTP plugin only
) To successfully downgrade Panorama to PAN-OS 10.2, you must uninstall the ZTP plugin before you begin the downgrade process. After successful downgrade to PAN-OS 10.2, you must reinstall the ZTP plugin on Panorama.
Downgrade each firewall running a PAN-OS 11.0 release.
Downgrading from PAN-OS 11.0 to a previous feature release requires that you first downgrade to the preferred PAN-OS 10.2 release or later PAN-OS 10.2 release. After successfully downgrading to the preferred PAN-OS 10.2 or later PAN-OS 10.2 release, you can continue downgrading to your target PAN-OS version.
If downgrading more than one firewall, streamline the process by having each firewall-specific PAN-OS 10.2 image downloaded to Panorama before you start downgrading. For example, to downgrade your PA-220 firewall to PAN-OS 10.2, download the
PanOS_220-10.2.0
or
PanOS_3000-10.2.0
images.
Panorama requires that all firewalls are running the same or an earlier PAN-OS release. So before you downgrade Panorama, use and repeat the appropriate tasks below according to your environment to downgrade all managed firewalls as needed:
Check Now
for available images (
Panorama
Device Deployment
Software
).
Locate the PAN-OS 10.2 image for each model or series of firewalls you intend to downgrade. If the image is not already downloaded, then
Download
it.
Non-HA Firewall
Install
(Action column) the appropriate PAN-OS 10.2 version, select all the firewalls you intend to downgrade, select
Reboot device after install
, and click
OK
.
Active/Active HA Firewalls
Click
Install
, disable (clear)
Group HA Peers
, select either of the HA peers, select
Reboot device after install
, and click
OK
. Wait for the firewall to finish rebooting before you proceed.
Click
Install
, disable (clear)
Group HA Peers
, select the HA peer that you didn’t update in the previous step, select
Reboot device after install
, and click
OK
.
Active/Passive HA Firewalls
In this example, the active firewall is named fw1 and the passive firewall is named fw2:
Install
(Action column) the appropriate update, disable (clear)
Group HA Peers
, select fw2, select
Reboot device after install
, and click
OK
.
After fw2 finishes rebooting, verify fw1 (
Dashboard
High Availability
widget) is still the active peer and that fw2 is still the passive peer (the Local firewall state is
active
and the Peer—fw2—is
passive
).
Access fw1 and
Suspend local device
(
Device
High Availability
Operational Commands
).
Access fw2 (
Dashboard
High Availability
) and verify that the Local firewall state is
active
and the Peer firewall—fw1—is
suspended
.
Access Panorama, select
Panorama
Device Deployment
Software
,
Install
(Action column) the appropriate update, disable (clear)
Group HA Peers
, select fw1, select
Reboot device after install
, and click
OK
. Wait for fw1 to finish rebooting before you proceed.
Access fw1 (
Dashboard
High Availability
widget) and verify that the Local firewall state is
passive
and the Peer—fw2—is
active
.
If you enabled preemption in the Election settings (
Device
High Availability
General
), then fw1 will be reinstated as the active peer after reboot.
Downgrade each Log Collector running Panorama 11.0.
Downgrading from PAN-OS 11.0 to a previous feature release requires that you first downgrade to the preferred PAN-OS 10.2 or later PAN-OS 10.2 release. After successfully downgrading to the preferred PAN-OS 10.2 or later PAN-OS 10.2 release, you can continue downgrading to your target PAN-OS version.
Check Now
for available images (
Panorama
Device Deployment
Software
).
Locate the Panorama 10.2 image. If the image is not already downloaded, then
Download
it (Action column).
After the download is complete,
Install
the image on each Log Collector running Panorama 10.2. Select
Reboot device after install
to automatically reboot the device when the upgrade is complete.
Downgrade Panorama.
Downgrading from PAN-OS 11.0 to a previous feature release requires that you first downgrade to the preferred PAN-OS 10.2 or later PAN-OS 10.2 release. After successfully downgrading to the preferred PAN-OS 10.2 or later PAN-OS 10.2 release, you can continue downgrading to your target PAN-OS version.
Select
Panorama
Software
and
Check Now
for available images.
Locate the Panorama 10.2 image. If the image is not already downloaded, then
Download
it.
After the download is complete,
Install
the image on Panorama.
Reboot Panorama as follows:
If you are prompted to reboot, click
Yes
. If you see a
CMS Login
prompt, press Enter without typing the username or password. When the Panorama login prompt appears, enter the username and password you set during initial configuration.
If you are not prompted to reboot, select
Panorama
Setup
Operations
and click
Reboot Panorama
(Device Operations).
(
ZTP plugin only
) Re-install the ZTP plugin.
Log in to the Panorama web interface.
Install the ZTP plugin.
Select
Panorama
Zero Touch Provisioning
and check (enable)
ZTP
.
(
Enterprise DLP only
) Edit the Enterprise DLP data filtering settings to reduce the
Max File Size
to 20MB or less.
This is required when downgrading from Panorama plugin for Enterprise DLP 4.0.1 or later release. Large file size inspection is supported on Enterprise DLP 4.0.1 and later releases.
(
Enterprise DLP only
) Synchronize the Enterprise DLP data filtering profiles on Panorama with the DLP cloud service.
This is required when downgrading Panorama from PAN-OS 11.0.2 and Enterprise DLP plugin 4.0.1 to PAN-OS 11.0.1 or earlier 11.0 release and Enterprise DLP plugin 4.0.0.
Log in to the Panorama CLI.
Push the Enterprise DLP configuration from Panorama to the DLP cloud service.
admin>
 request plugins dlp push-dlp-config
Reset the Enterprise DLP plugin.
admin>
 request plugins dlp reset
Commit on Panorama and push to managed firewalls using Enterprise DLP.
Log in to the Panorama web interface.
Select
Commit
Commit to Panorama
and
Commit
.
Select
Commit
Push to Devices
and
Edit Selections
.
Select
Device Groups
and
Include Device and Network Templates
.
Click
OK
.
Push
your configuration changes to your managed firewalls that are using Enterprise DLP.