HA Upgrade Orchestration for NGFW
Automate HA firewall pair upgrades from Strata Cloud Manager to reduce manual effort
and eliminate human error during PAN-OS software upgrades.
| Where Can I Use This? | What Do I Need? |
|---|
- NGFW (Managed by Strata Cloud Manager)
|
- Strata Cloud Manager Essentials
- Strata Cloud Manager Pro
- An HA firewall pair (Active/Passive or Active/Active) connected
to Strata Cloud Manager
|
Upgrading high availability (HA) firewall pairs requires a carefully orchestrated
sequence of steps: suspending HA on one firewall, upgrading it, switching traffic over,
upgrading the peer, and restoring the original HA state. Performing these steps manually
is time-consuming, error-prone, and difficult to scale across many HA pairs. HA Upgrade
Orchestration automates this entire process from Strata Cloud Manager, so you can
upgrade HA firewall pairs with a single scheduled operation.
When you create a software update schedule with HA Orchestration enabled, Strata Cloud Manager automatically detects HA pairs based on firewall peer
relationships. Each detected HA pair follows the orchestrated upgrade workflow, while
standalone (non-HA) firewalls in the same schedule follow the standard upgrade path. You
can include a mix of HA pairs and standalone firewalls in a single schedule.
The orchestration handles all phases of the upgrade process, including pre-checks,
content and software download, installation, HA suspend, switchover, reboot, version
verification, and HA state restoration. Throughout the process, you can monitor
real-time progress for each HA pair from the Strata Cloud Manager dashboard.
How HA Upgrade Orchestration Works (Active/Passive)
For Active/Passive HA pairs, the orchestration upgrades the passive firewall first
and then upgrades the active firewall. This approach ensures that a firewall is
always handling traffic throughout the upgrade process. The initial phases
(pre-check, content update, and download) run on both firewalls.
The following table shows the upgrade stages for each firewall in the pair as
displayed in the Strata Cloud Manager upgrade progress view.
| Active Firewall Stage | Active Firewall Description | Passive Firewall Stage | Passive Firewall Description |
|---|
| Pre-check | Validates HA health, connectivity to Strata Cloud Manager, and
content versions on both firewalls. | Pre-check | Validates HA health, connectivity to Strata Cloud Manager, and
content versions on both firewalls. |
| Content | Updates content on both firewalls. | Content | Updates content on both firewalls. |
| Download | Downloads the target PAN-OS version on both firewalls. | Download | Downloads the target PAN-OS version on both firewalls. |
| Suspend | Suspends HA on the passive firewall. The active firewall
continues handling all traffic. No switchover occurs because the
passive firewall was not handling active traffic. | SwitchOver HA | The active firewall is suspended, triggering a switchover. The
passive firewall assumes the active role and begins handling all
traffic. |
| Upgrade (Post check) | Reboots the active firewall with the new PAN-OS version after the
passive is upgraded and switchover is complete. Verifies the
software version and auto-commit. | -- | Monitors HA state until the passive firewall fully assumes the
active role. |
| SwitchOver HA | Suspends HA on the active firewall, triggering a switchover to
the upgraded passive firewall, which becomes the new active
device. | Suspend | Suspends HA on the passive (now active) firewall to prepare for
upgrade. |
| -- | Monitors HA state until the previously passive firewall fully
assumes the active role. | Upgrade (Install) | Reboots the passive firewall with the new PAN-OS version and
verifies the software version and auto-commit. |
| Resume HA Original state | Restores the original HA roles so that the firewall that was
active before the upgrade returns to the active role. | Resume HA Original state | Restores the original HA roles. |
| Post Check | Verifies HA synchronization, configuration sync, and system
health on both firewalls after the upgrade is complete. | Post-check | Verifies HA synchronization, configuration sync, and system
health on both firewalls after the upgrade is complete. |
How HA Upgrade Orchestration Works (Active/Active)
For Active/Active HA pairs, both firewalls handle active traffic simultaneously.
Because of this, suspending either firewall requires a switchover to transfer
traffic to the peer. This adds one extra phase compared to Active/Passive: a
switchover wait after suspending the first (secondary-active) firewall.
The following table shows the upgrade stages for each device in the pair as displayed
in the Strata Cloud Manager upgrade progress view.
| Primary Device Stage | Primary Device Description | Secondary Device Stage | Secondary Device Description |
|---|
| Pre-check | Validates HA health, connectivity to Strata Cloud Manager, and
content versions on both devices. | Pre-check | Validates HA health, connectivity to Strata Cloud Manager, and
content versions on both devices. |
| Content | Updates content on both devices. | Content | Updates content on both devices. |
| Download | Downloads the target PAN-OS version on both devices. | Download | Downloads the target PAN-OS version on both devices. |
| Suspend | Suspends the secondary-active device. The primary-active device
takes over all traffic. | SwitchOver HA | The secondary-active device is suspended. The primary-active
device takes over all traffic. |
| -- | Monitors HA state until the primary-active device is handling all
traffic. | Upgrade (Install) | Reboots the secondary device with the new PAN-OS version after
switchover is complete. Verifies the software version and
auto-commit. |
| SwitchOver HA | Suspends the primary-active device. The upgraded secondary-active
device takes over all traffic. | Suspend | Suspends the primary-active device. The upgraded secondary-active
device takes over all traffic. |
| -- | Monitors HA state until the secondary-active device is handling
all traffic. | Upgrade (Install) | Reboots the secondary device with the new PAN-OS version and
verifies the software version and auto-commit. |
| Resume HA Original state | Restores the original active-primary/active-secondary roles to
match the pre-upgrade configuration. | Resume HA Original state | Restores the original active-primary/active-secondary
roles. |
| Post Check | Verifies HA synchronization, configuration sync, and system
health on both devices after the upgrade is complete. | Post-check | Verifies HA synchronization, configuration sync, and system
health on both devices after the upgrade is complete. |
Monitor HA Upgrade Progress
After you create an HA upgrade schedule, you can monitor the progress of each HA pair
from the Strata Cloud Manager dashboard. Select and select the active job to view per-pair progress.
The status view displays both the primary and secondary devices in each HA pair along
with their current workflow phase. Each phase shows a visual indicator:
- Green—The phase completed successfully.
- Purple—The phase is currently in progress.
- Red—The phase failed.
Hover over a completed or in-progress phase to see the duration and additional status
details, such as the start time, end time, and any error messages.
If you include multiple HA pairs in a single schedule, each pair upgrades
independently. A failure in one HA pair does not affect the upgrade of other pairs
in the same schedule.
Limitations and Platform Constraints
HA Upgrade Orchestration has the following limitations:
- HA Orchestration supports only the Download-Install-Reboot job type. You
cannot run download-only, install-only, or download-and-install operations
separately when HA Orchestration is enabled.
- The Download software in advance option is not supported with HA
Orchestration.
- HA Orchestration supports only one-time schedules. Interval-based (recurring)
software update schedules are not supported.
- Both firewalls in an HA pair must be operational and connected to Strata Cloud Manager before you start the upgrade. The pre-check phase
validates this requirement.
The following table lists platform-specific constraints for HA Upgrade
Orchestration.
| Platform | HA Orchestration Support | Details |
|---|
| PA-7500 Series | Active/Passive only | Active/Active HA is not supported at the PAN-OS level for this
platform. |
| VM-Series on Azure | Active/Passive only | Active/Active HA is not supported on this platform. |
| VM-Series on AWS | Active/Passive only | Active/Active HA is not supported on this platform. |
| VM-Series on GCP | Not supported | HA is not supported on GCP. |
Best Practices for HA Upgrade Orchestration
Follow these best practices when using HA Upgrade Orchestration:
- Verify that both firewalls in each HA pair are healthy and connected to Strata Cloud Manager before creating an upgrade schedule. The pre-check phase
fails if either firewall is unreachable or HA links are down.
- Allow sufficient time for the upgrade to complete. The HA orchestration process
takes approximately 45 to 50 minutes on hardware firewalls. Virtual firewalls
typically complete faster depending on the configuration. If your HA
configuration is set with a longer HA stabilization time, the upgrade can take
more than an hour. The orchestrator waits for HA to fully stabilize after each
reboot or switchover before proceeding to the next phase.
- Monitor the upgrade progress from the Strata Cloud Manager dashboard. If a
phase fails, the orchestration retries the operation automatically. After
exhausting retries, the job is marked as failed, and you may need to reschedule
the upgrade or take manual corrective action.
- If the Restore HA State phase fails, the PAN-OS upgrade itself has completed
successfully on both firewalls. However, the HA roles may not match the original
pre-upgrade state. Verify the HA configuration on each firewall and manually
restore the roles if needed.
- HA Upgrade Orchestration is form-factor agnostic. You can use it with hardware
firewalls and VM-Series firewalls (on supported platforms). The orchestration
adjusts polling intervals and timeouts automatically based on firewall
responsiveness.
