Panorama HA Pair: Upgrade SD-WAN Plugin 1.0.4 to 2.2.6 Release

Upgrade your Panorama management server version.
From Panorama 9.1.x, download and install Panorama 10.0.7-h3 on both active and passive Panorama.

From Panorama 10.0.7-h3, download and install the latest Panorama 10.1 release on both active and passive Panorama.

After the Panorama is upgraded to the latest 10.1 release, check if the active Panorama remains as active and the passive Panorama remains as passive. If there is no change in the HA states, then the upgrade is successful. Otherwise, you need to perform a force switch over to maintain the state of the HA pairs that it was before the upgrade.

To perform the force switchover, execute the following CLI commands in the same order from the current active HA peer.

admin > 
request high-availbility state suspend

admin > 
request high-availbility state functional
Monitor the
configd
logs.
(
In administrator mode
) Before upgrading the SD-WAN plugin to 2.2.6, start monitoring the
configd
log on both the Panorama HA pairs.
admin> 
tail follow yes mp-log configd.log
If you see the below error message on executing
tail follow yes mp-log configd.log
command, the Mongo DB of the active and passive Panorama has become out of sync.
To resolve this issue:
(

In administrator mode

) Drop the whole database

pan_oplog

on both the active and passive Panorama.

admin > 
debug mongo drop database pan_oplog instance mdb 

(

In administrator mode

) Restart

configd

on both the active and passive Panorama.

admin > 
debug software restart process configd
Once the
configd
is restarted, refresh the respective web interface and command line interface. After restart, you won't be seeing the
mongo pan_oplog
error on any of the commit processes.
We recommend you to monitor the
configd
logs during the whole upgrade process.
Download and install the SD-WAN plugin version 2.2.6 on both active and passive Panorama.
(
In administrator mode
) Drop the SD-WAN collections on both active and passive Panorama.
admin > 
debug mongo drop database pl_sd_wan instance mdb
This step is required to make the SD-WAN Mongo DB collections in synchronization.
(
In configuration mode
) Forcefully commit the changes from the active Panorama.
After completing the SD-WAN plugin upgrade, you must perform a commit force through the CLI command (in the configuration mode) on the Palo Alto Networks device. If you perform commit all instead of commit force, then you will lose all the SD-WAN configurations on that device.
Check the following after Panorama HA upgrade.
Perform a selective push to branch devices first, followed by the hub devices from active Panorama.
Select
Panorama
Managed Devices
Summary
and verify if the device group and templates are in synchronization on both active and passive Panorama under the devices summary page.
Verify if the SD-WAN configurations such as, Tunnel, BGP, Key ID, and traffic are as expected.
After successful upgrade of the Panorama HA pair, the Key ID, PSK, IP cache, IPSec tunnel cache, and subnet cache will be refreshed which will not affect the functionalities of SD-WAN.
(
Recommended
) Upgrade the connected firewalls.
Once the Panorama HA pair upgrade is successful, the connected hub and branch devices can be upgraded one-by-one starting with the branch firewalls followed by hub firewalls (the branch and hub firewalls can be standalone firewalls or HA pairs).
We recommend you to check the SD-WAN configuration and functionality after upgrading each firewall.
Introduce a minor change on all the templates by modifying or adding the comment for an interface on the template, followed by a
Commit
and
Push to Devices
. This is just a verification activity to ensure that the configuration is good and the upgrade is working.
Check the SD-WAN configuration and functionalities.
Upgrade the branch firewall one-by-one till all the branches are upgraded.
Follow the below steps for branch firewalls first.
Start upgrading a pair of branch HA or standalone devices from Panorama version 9.1.x to 10.0.7-h3, and then to the latest Panorama 10.1 release.
Introduce a minor change in the comment of an interface from the particular firewall template from the active Panorama where the upgrade was performed,
Commit
, and
Push to Devices
. Once the
Commit All
is completed, check the SD-WAN configurations and functionalities. This is just a verification activity to ensure that the configuration is good and the upgrade is working after the firewall is upgraded.
Follow the below steps for the hub firewalls. It's important that you complete the upgrade of the branch firewalls and then start the upgrade of the hub firewalls.
Start upgrading a pair of hub HA or standalone devices from Panorama version 9.1.x to 10.0.7-h3, and then to the latest Panorama 10.1 release.
Introduce a minor change in the comment of an interface from the particular firewall template from the active Panorama where the upgrade was performed,
Commit
, and
Push to Devices
. Once the
Commit All
is completed, check the SD-WAN configurations and functionalities.
This is just a verification activity to ensure that the configuration is good and the upgrade is working after the firewall is upgraded.
Select
Panorama
Managed Devices
Summary
and verify if the device group and templates are in synchronization on both active and passive Panorama under the devices summary page.
After the upgrade is complete, note the changes after the upgrade.