Upgrade Log Collectors When Panorama Is Not Internet-Connected

Before you upgrade Log Collectors, ensure that you are running the appropriate Panorama™ software release on the Panorama management server.
Palo Alto Networks® highly recommends that Panorama and Log Collectors run the same software release version and that Panorama, Log Collectors, and all managed firewalls run the same content release version. For important software and content compatibility details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
Panorama must be running the same (or later) software release as Log Collectors but must have the same or later content release version:
Software release version
—If your Panorama management server is not already running the same or a later software release than the release to which you intend to update Log Collectors, then you must install the same or a later Panorama release on Panorama (see Install Content and Software Updates for Panorama) before you update any Log Collectors.
Content release version
—For content release versions, you should ensure that all Log Collectors are running the latest content release version or, at minimum, running a later version than you will install or that is running on Panorama; if not, then first Upgrade the Firewall to PAN-OS 11.1 from Panorama and then update Log Collectors before you update the content release version on the Panorama management server (see Install Content Updates and Software Upgrades for Panorama).
To check the software and content versions:
Panorama management server
—To determine which software and content versions are running on the Panorama management server, log in to the Panorama web interface and go to General Information settings (
Dashboard
).
Log Collectors
—To determine which software and content versions are running on Log Collectors, log in to the CLI of each Log Collector and run the
show system info
command.
Determine the Upgrade Path to PAN-OS 11.1.
Review PAN-OS Upgrade Checklist, the known issues and changes to default behavior in the Release Notes and Upgrade/Downgrade Considerations for each release through which you pass as part of your upgrade path.
If upgrading more than one Log Collector, streamline the process by determining the upgrade paths for all Log Collectors you intend to upgrade before you start downloading images.
Enable the following TCP ports on your network.
These TCP ports must be enabled on your network to allow inter-Log Collector communication.
TCP/9300
TCP/9301
TCP/9302
Download the latest content and software updates to a host that can connect and upload the files to Panorama either over SCP or HTTPS.
Refer to the Release Notes for the minimum content release versions required for a Panorama software release.
Use a host with internet access to log in to the Palo Alto Networks Customer Support web site.
Download the latest content updates:
Click
Dynamic Updates
in the Resources section.
Download
the latest content updates and save the files to the host. Perform this step for each content type you will update.
Download the software updates:
Return to the main page of the Palo Alto Networks® Customer Support website and click
Software Updates
in the Resources section.
Review the Download column to determine which version to install. The update package filenames for M-Series appliances begin with “Panorama_m” followed by the release number. For example, to upgrade an M-Series appliance to Panorama 11.1.0, download the
Panorama_m-11.1.0
image.
You can quickly locate Panorama images by selecting
Panorama M Images
(for M-Series appliances) from the
Filter By
drop-down.
Click the appropriate filename and save the file to the host.
Install the latest content updates.
If you need to install content updates, you must do so before you install software updates. Additionally, install content updates on firewalls first and then on Log Collectors before you update the content release version on Panorama.
Install the Applications or Applications and Threats update first and then install any other updates (Antivirus, WildFire®, or URL Filtering) as needed, one at a time, and in any sequence.
Regardless whether your subscription includes both Applications and Threats content, Panorama installs and needs only the Applications content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
Log in to the Panorama web interface.
Select
Panorama
Device Deployment
Dynamic Updates
.
Click
Upload
, select the update
Type
,
Browse
to the appropriate content update file on the host, and click
OK
.
Click
Install From File
, select the update
Type
, and select the
File Name
of the update you just uploaded.
Select the Log Collectors.
Click
OK
to start the installation.
Repeat these steps for each content update.
Upgrade the Log Collector to the PAN-OS releases along your upgrade path to PAN-OS 11.1.
Upgrade Log Collectors When Panorama is Not Internet-Connected to PAN-OS 9.1.
Upgrade Log Collectors When Panorama is Not Internet-Connected to PAN-OS 10.0.
Upgrade Log Collectors When Panorama is Not Internet-Connected to PAN-OS 10.1.
PAN-OS 10.0 introduces a new log format. On upgrade from PAN-OS 10.0 to PAN-OS 10.1, you can choose to migrate logs generated in PAN-OS 8.1 or earlier release. Otherwise, these logs are automatically deleted on successful upgrade to PAN-OS 10.1. During migration, log data is not visible in the ACC or Monitor tabs. While the migration takes place, log data continues forwarding to the appropriate Log Collector but you may experience some impact to performance.
Upgrade Log Collectors When Panorama is Not Internet-Connected to PAN-OS 10.2.
Upgrade Log Collectors When Panorama is Not Internet-Connected to PAN-OS 11.0.
Upgrade the Log Collector to PAN-OS 11.1.
Select
Panorama
Device Deployment
Software
.
Click
Upload
,
Browse
to the appropriate software update file on the host, and click
OK
.
Click
Install
in the Action column for the release you just uploaded.
Install
PAN-OS 11.1 and select the appropriate Log Collectors.
A notification is displayed if one or more selected Log Collector contain logs generated in PAN-OS 10.0 or earlier releases.
This notification is displayed the first time you attempt to
Install
PAN-OS 11.1.2 or later 11.1 release and is not displayed a second time after the notification is closed. It warns you that logs generated by Panorama or managed devices when running PAN-OS 10.0 or earlier release are detected and will be deleted on upgrade. This means that the impacted logs are not viewable or searchable after successful upgrade.
However, you can recover these impacted logs after upgrade. The notification also provides you with the following information. If multiple Log Collectors are selected, click
Tasks
and view the failed
Install
job details for each Log Collector to view and copy the required migration commands.
Impacted log types.
Impacted time frames for each log type.
Each
debug logdb migrate-lc
command required to recover the impacted logs for each log type.
Copy the listed
debug logdb migrate-lc
before you
Close
the notification.
Close
the notification.
Select one of the following depending on your needs:
Upload only to device (do not install)
.
Reboot device after install
.
Click
OK
to start the upload or installation.
Continue to the next step after the selected Log Collectors successfully reboot.
Verify the software and content versions that are installed on each Log Collector.
Log in to the Log Collector CLI and enter the
show system info
operational command. The output will resemble the following:
sw-version: 11.1.0 
app-version: 8750-8261 
app-release-date: 2023/08/31 03:57:2 
(
PAN-OS 11.1.2 and later releases; Panorama mode only
) Log in to the Log Collector CLI of each impacted Log Collector and recover the impacted logs using the
debug logdb migrate-lc
commands listed in the previous step.
These commands must be run sequentially and cannot be run simultaneously. If you didn't copy the
debug logdb migrate-lc
commands from the notification window, click
Tasks
and view the failed
Install
job details for the particular Log Collector.
(
FIPS-CC mode only
) Upgrade Panorama and Managed Devices in FIPS-CC Mode.
Upgrading a Dedicated Log Collector in FIPS-CC mode requires you to reset the secure connection status if you added the Dedicated Log Collector to Panorama management while the Dedicated Log Collector was running a PAN-OS 11.1 release.
You do not need to re-onboard the Dedicated Log Collector added to Panorama management while the Dedicated Log Collector was running a PAN-OS 10.0 or earlier release.
(
PAN-OS 10.2 and later releases
) Regenerate or re-import all certificates to adhere to OpenSSL Security Level 2.
This step is required if you upgrade from PAN-OS 10.1 or earlier release to PAN-OS 11.0. Skip this step if you upgrade from PAN-OS 10.2 and have already regenerated or re-imported your certificates.
It is required that all certificates meet the following minimum requirements:
RSA 2048 bits or greater, or ECDSA 256 bits or greater
Digest of SHA256 or greater
See the PAN-OS Administrator's Guide or Panorama Administrator's Guide for more information on regenerating or re-importing your certificates.
(
Recommended for Panorama virtual appliance
) Increase the memory of the Panorama virtual appliance to 64GB.
After you successfully upgrade the Panorama virtual appliance in Log Collector mode to PAN-OS 11.1, Palo Alto Networks recommends increasing the memory of the Panorama virtual appliance to 64GB to meet the increased system requirements to avoid any logging, management, and operational performance issues related to an under-provisioned Panorama virtual appliance.