Upgrade an HA Firewall Pair
Table of Contents
10.0 (EoL)
Expand all | Collapse all
-
- Automatic Content Updates Through Offline Panorama
- Enhanced Authentication for Dedicated Log Collectors and WildFire Appliances
- Syslog Forwarding Using Ethernet Interfaces
- Increased Configuration Size for Panorama
- Access Domain Enhancements for Multi-Tenancy
- Enhanced Performance for Panorama Query and Reporting
- Log Query Debugging
- Configurable Key Limits in Scheduled Reports
- Multiple Plugin Support for Panorama
End-of-Life (EoL)
Upgrade an HA Firewall Pair
Follow these steps to upgrade an HA firewall pair to
PAN-OS 10.0.
Review the PAN-OS 10.0 Release Notes and
then use the following procedure to upgrade a pair of firewalls
in a high availability (HA) configuration. This procedure applies
to both active/passive and active/active configurations.
To
avoid downtime when upgrading firewalls that are in a high availability
(HA) configuration, update one HA peer at a time: For active/active
firewalls, it doesn’t matter which peer you upgrade first (though
for simplicity, this procedure shows you how to upgrade the active-primary
peer first). For active/passive firewalls, you must suspend (fail
over) and upgrade the active (primary) peer first. After you upgrade the
primary peer, you must unsuspend the primary peer to return it to
a functional state (passive). Next, you must suspend the passive
(secondary) peer to make the primary peer active again. After the
primary peer is active and the secondary peer is suspended, you
can continue the upgrade. To prevent failover during the upgrade of
the HA peers, you must make sure preemption is disabled before proceeding
with the upgrade. You only need to disable preemption on one peer
in the pair.
(
A/P HA Configuration only
) When upgrading
HA firewalls across multiple feature PAN-OS releases, you must upgrade
each HA peer to the same feature PAN-OS release on your upgrade
path before continuing. For example, you are upgrading HA peers
from PAN-OS 9.0 to PAN-OS 10.0. You must upgrade both HA peers to
PAN-OS 9.1 before you can continue upgrading to the target PAN-OS
10.0 release.To avoid impacting traffic,
plan to upgrade within the outage window. Ensure the firewalls are
connected to a reliable power source. A loss of power during an
upgrade can make firewalls unusable.
- Save a backup of the current configuration file.Although the firewall automatically creates a backup of the configuration, it is a best practice to create and externally store a backup before you upgrade.Perform these steps on each firewall in the pair:
- Selectand clickDeviceSetupOperationsExport named configuration snapshot.
- Select the XML file that contains your running configuration (for example,running-config.xml) and clickOKto export the configuration file.
- Save the exported file to a location external to the firewall. You can use this backup to restore the configuration if you have problems with the upgrade.
- SelectandDeviceSupportGenerate Tech Support File.ClickYeswhen prompted to generate the tech support file.
- If you have enabled User-ID, after you upgrade, the firewall clears the current IP address-to-username and group mappings so that they can be repopulated with the attributes from the User-ID sources. To estimate the time required for your environment to repopulate the mappings, run the following CLI commands on the firewall.
- For IP address-to-username mappings:
- show user user-id-agent state all
- show user server-monitor state all
- For group mappings:show user group-mapping statistics
- Ensure that each firewall in the HA pair is running the latest content release version.Refer to the release notes for the minimum content release version you must install for a PAN-OS 10.0 release. Make sure to follow the Best Practices for Application and Threat Updates.
- Selectand check whichDeviceDynamic UpdatesApplicationsorApplications and Threatsto determine which update is Currently Installed.
- If the firewalls are not running the minimum required content release version or a later version required for PAN-OS 10.0,Check Nowto retrieve a list of available updates.
- Locate andDownloadthe desired content release version.After you successfully download a content update file, the link in the Action column changes fromDownloadtoInstallfor that content release version.
- Installthe update. You must install the update on both peers.
- You cannot skip installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 10.0.0.Review the known issues and changes to default behavior in the Release Notes and upgrade/downgrade considerations in the New Features Guide for each release through which you pass as part of your upgrade path.
- If Control Link (HA1) Encryption is enabled, disable it on both HA peers.
- Selectand edit the Control Link (HA1) section.DeviceHigh AvailabilityGeneral
- UncheckEncryption Enabledso that it is disabled.
- Committhe change on both peers.
- Disable preemption on the first peer in each pair. You only need to disable this setting on one firewall in the HA pair but ensure that the commit is successful before you proceed with the upgrade.
- Selectand edit theDeviceHigh AvailabilityElection Settings.
- If enabled, disable (clear) thePreemptivesetting and clickOK.
- Committhe change.
- Suspend the primary HA peer to force a failover.(Active/passive firewalls) For firewalls in an active/passive HA configuration, suspend and upgrade the active HA peer first.(Active/active firewalls) For firewalls in an active/active HA configuration, suspend and upgrade the active-primary HA peer first.
- SelectandDeviceHigh AvailabilityOperational CommandsSuspend local device for high availability.
- In the bottom-right corner, verify that the state issuspended.The resulting failover should cause the secondary HA peer to transition toactivestate.The resulting failover verifies that HA failover is functioning properly before you upgrade.
- Install PAN-OS 10.0 on the suspended peer.
- On the first peer, selectand clickDeviceSoftwareCheck Nowfor the latest updates.
- Locate andDownloadPAN-OS 10.0.0.If your firewall does not have internet access from the management port, you can download the software image from the Palo Alto Networks Support Portal and then manuallyUploadit to your firewall.
- After you download the image (or, for a manual upgrade, after you upload the image),Installthe image.
- After the installation completes successfully, reboot using one of the following methods:
- If you are prompted to reboot, clickYes.
- If you are not prompted to reboot, selectandDeviceSetupOperationsReboot Device.
- After the device finishes rebooting, view the High Availability widget on theDashboardand verify that the device you just upgraded is in sync with the peer.
- Restore HA functionality to the primary HA peer.
- SelectandDeviceHigh AvailabilityOperational CommandsMake local device functional for high availability.
- In the bottom-right corner, verify that the state isPassive. For firewalls in an active/active configuration, verify that the state isActive.
- Wait for the HA peer running configuration to synchronize.In theDasbhoard, monitor the Running Config status in the High Availability widget.
- On the secondary HA peer, suspend the HA peer.
- SelectandDeviceHigh AvailabilityOperational CommandsSuspend local device for high availability.
- In the bottom-right corner, verify that the state issuspended.The resulting failover should cause the primary HA peer to transition toActivestate.
- Install PAN-OS 10.0 on the secondary HA peer.
- On the second peer, selectand clickDeviceSoftwareCheck Nowfor the latest updates.
- Locate andDownloadPAN-OS 10.0.0.
- After you download the image,Installit.
- After the installation completes successfully, reboot using one of the following methods:
- If you are prompted to reboot, clickYes.
- If you are not prompted to reboot, selectandDeviceSetupOperationsReboot Device.
- Restore HA functionality to the secondary HA peer.
- SelectandDeviceHigh AvailabilityOperational CommandsMake local device functional for high availability.
- In the bottom-right corner, verify that the state isPassive. For firewalls in an active/active configuration, verify that the state isActive.
- Wait for the HA peer running configuration to synchronize.In theDasbhoard, monitor the Running Config status High Availability widget.
- If you disabled Control Link (HA1) Encryption, re-enable it on both firewalls.
- Export the HA key from one firewall and import it into the peer firewall.
- Select.DeviceCertificate ManagementCertificates
- SelectExport HA key. Save the HA key to a network location that the peer can access.
- On the peer firewall, select, and selectDeviceCertificate ManagementCertificatesImport HA keyto browse to the location where you saved the key and import it into the peer.
- Repeat this step on the peer firewall to exchange HA keys on both devices.
- Selectand edit the Control Link (HA1) section.DeviceHigh AvailabilityGeneral
- SelectEncryption Enabled.
- Committhe change.
- Repeat this step on the peer firewall.
- Re-enable preemption on the HA peer where it was disabled in the previous step.
- Selectand edit theDeviceHigh AvailabilityElection Settings.
- Enable (check) thePreemptivesetting and clickOK.
- Committhe change.
- Verify that both peers are passing traffic as expected.In an active/passive configuration, only the active peer should be passing traffic; both peers should be passing traffic in an active/active configuration.Run the following CLI commands to confirm that the upgrade succeeded:
- (Active peers only) To verify that active peers are passing traffic, run theshow session allcommand.
- To verify session synchronization, run theshow high-availability interface ha2command and make sure that the Hardware Interface counters on the CPU table are increasing as follows:
- In an active/passive configuration, only the active peer shows packets transmitted; the passive peer will show only packets received.If you enabled HA2 keep-alive, the hardware interface counters on the passive peer will show both transmit and receive packets. This occurs because HA2 keep-alive is bi-directional, which means that both peers transmit HA2 keep-alive packets.
- In an active/active configuration, you will see packets received and packets transmitted on both peers.