Upgrade Log Collectors When Panorama Is Not Internet-Connected
Table of Contents
Expand all | Collapse all
-
-
- Upgrade Panorama with an Internet Connection
- Upgrade Panorama Without an Internet Connection
- Install Content Updates Automatically for Panorama without an Internet Connection
- Upgrade Panorama in an HA Configuration
- Migrate Panorama Logs to the New Log Format
- Upgrade Panorama for Increased Device Management Capacity
- Downgrade from Panorama 10.1
- Troubleshoot Your Panorama Upgrade
-
- What Updates Can Panorama Push to Other Devices?
- Schedule a Content Update Using Panorama
- Panorama, Log Collector, Firewall, and WildFire Version Compatibility
- Upgrade Log Collectors When Panorama Is Internet-Connected
- Upgrade Log Collectors When Panorama Is Not Internet-Connected
- Upgrade a WildFire Cluster from Panorama with an Internet Connection
- Upgrade a WildFire Cluster from Panorama without an Internet Connection
- Upgrade Firewalls When Panorama Is Internet-Connected
- Upgrade Firewalls When Panorama Is Not Internet-Connected
- Upgrade a ZTP Firewall
- Revert Content Updates from Panorama
-
Upgrade Log Collectors When Panorama Is Not Internet-Connected
Upgrade Log Collector software to PAN-OS® 10.1 and install
content updates using Panorama™ when Panorama is not connected to
the internet.
For a list of software or content updates
you can install on Log Collectors, see Supported
Updates.
PAN-OS® 10.1 introduces a new log format. On upgrade from PAN-OS 10.0 to PAN-OS 10.1, you can
choose to migrate logs generated in PAN-OS 8.1 or earlier release. Otherwise, these
logs are automatically deleted on successful upgrade to PAN-OS 10.1. During
migration, log data is not visible in the ACC or
Monitor tabs. While the migration takes place, log data
continues forwarding to the appropriate Log Collector but you may experience some
impacts to performance.
If you are upgrading from PAN-OS 8.1, PAN-OS
9.0 introduced a new log data format for local and Dedicated Log
Collectors. On your upgrade path to PAN-OS 10.1, existing log data
is automatically migrated to the new format when you upgrade from
PAN-OS 8.1 to PAN-OS 9.0.
You must upgrade all Log
Collectors in a collector group at the same time to avoid losing
log data. No log forwarding or log collection occurs if the Log
Collectors in a collector group are not all running the same PAN-OS
version. Additionally, the log data for the Log Collectors in the
collector group is not visible in the ACC or Monitor tabs
until all Log Collectors are running the same PAN-OS version. For
example, if you have three Log Collectors in a collector group and
you upgrade two of the Log Collectors, then no logs are forwarded
to any Log Collectors in the collector group.
Palo Alto Networks
recommends that you upgrade Log Collectors during a maintenance
window. Due to log format migration, the entire upgrade procedure
takes an additional number of hours depending on the amount of log
data on the local and Dedicated Log Collectors.
- Before you upgrade Log Collectors, ensure that you are running the appropriate Panorama™ software release on the Panorama management server.Palo Alto Networks® highly recommends that Panorama and Log Collectors run the same software release version and that Panorama, Log Collectors, and all managed firewalls run the same content release version. For important software and content compatibility details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.Panorama must be running the same (or later) software release as Log Collectors but must have the same or later content release version:
- Software release version—If your Panorama management server is not already running the same or a later software release than the release to which you intend to update Log Collectors, then you must install the same or a later Panorama release on Panorama (see Install Content and Software Updates for Panorama) before you update any Log Collectors.
- Content release version—For content release versions, you should ensure that all Log Collectors are running the latest content release version or, at minimum, running a later version than you will install or that is running on Panorama; if not, then first update managed firewalls (using Panorama) and then update Log Collectors before you update the content release version on the Panorama management server (see Install Content Updates and Software Upgrades for Panorama).
To check the software and content versions:- Panorama management server—To determine which software and content versions are running on the Panorama management server, log in to the Panorama web interface and go to General Information settings (Dashboard).
- Log Collectors—To determine which software and content versions are running on Log Collectors, log in to the CLI of each Log Collector and run the show system info command.
Determine the Upgrade Path to PAN-OS 10.1.You cannot skip the installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 10.1Review PAN-OS Upgrade Checklist, the known issues and changes to default behavior in the Release Notes and Upgrade/Downgrade Considerations for each release through which you pass as part of your upgrade path.If upgrading more than one Log Collector, streamline the process by determining the upgrade paths for all Log Collectors you intend to upgrade before you start downloading images.Download the latest content and software updates to a host that can connect and upload the files to Panorama either over SCP or HTTPS.Refer to the Release Notes for the minimum content release versions required for a Panorama software release.- Use a host with internet access to log in to the Palo Alto Networks Customer Support web site.Download the latest content updates:
- Click Dynamic Updates in the Resources section.
- Download the latest content updates and save the files to the host. Perform this step for each content type you will update.
Download the software updates:- Return to the main page of the Palo Alto Networks® Customer Support website and click Software Updates in the Resources section.
- Review the Download column to determine which version to install. The update package filenames for M-Series appliances begin with “Panorama_m” followed by the release number. For example, to upgrade an M-Series appliance to Panorama 10.1.0, download the Panorama_m-10.1.0 image.You can quickly locate Panorama images by selecting Panorama M Images (for M-Series appliances) from the Filter By drop-down.
Click the appropriate filename and save the file to the host.Install the latest content updates.If you need to install content updates, you must do so before you install software updates. Additionally, install content updates on firewalls first and then on Log Collectors before you update the content release version on Panorama.Install the Applications or Applications and Threats update first and then install any other updates (Antivirus, WildFire®, or URL Filtering) as needed, one at a time, and in any sequence.Regardless whether your subscription includes both Applications and Threats content, Panorama installs and needs only the Applications content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.- Log in to the Panorama web interface.Select PanoramaDevice DeploymentDynamic Updates.Click Upload, select the update Type, Browse to the appropriate content update file on the host, and click OK.Click Install From File, select the update Type, and select the File Name of the update you just uploaded.Select the Log Collectors.Click OK to start the installation.Repeat these steps for each content update.Determine the Upgrade Path to PAN-OS 10.1You cannot skip installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 10.1.0.Review PAN-OS Upgrade Checklist, the known issues and changes to default behavior in the Release Notes and upgrade/downgrade considerations in the New Features Guide for each release through which you pass as part of your upgrade path.Upgrade the Log Collector to the PAN-OS releases along your upgrade path to PAN-OS 10.1.
- Upgrade Log Collectors When Panorama is Not Internet-Connected to PAN-OS 8.1.Upgrade Log Collectors When Panorama is Not Internet-Connected to PAN-OS 9.0.PAN-OS 9.0 introduced a new log format. Logs are automatically migrated to the new format after you successfully upgrade the Log Collector to PAN-OS 9.0.Do not continue on your upgrade path until you verify the automatic log migration completed successfully.Upgrade Log Collectors When Panorama is Not Internet-Connected to PAN-OS 9.1.Upgrade Log Collectors When Panorama is Not Internet-Connected to PAN-OS 10.0.Upgrade the Log Collector to PAN-OS 10.1.
- Select PanoramaDevice DeploymentSoftware.Click Upload, Browse to the appropriate software update file on the host, and click OK.Click Install in the Action column for the release you just uploaded.Install PAN-OS 10.1 and select the appropriate Log Collectors.Select one of the following depending on your needs:
- Upload only to device (do not install).
- Reboot device after install.
Click OK to start the upload or installation.(Logs generated in PAN-OS 8.1 or earlier releases only) If the Log Collector stores logs generated in PAN-OS 8.1 or earlier release, the upgrade to PAN-OS 10.1 is blocked to alert you that logs generated in PAN-OS 8.1 or earlier release are automatically deleted on upgrade to PAN-OS 10.1.Acknowledge the notification and Install PAN-OS 10.1 again.After successful upgrade to PAN-OS 10.1, CLI commands are provided to recover and migrate all logs generated in PAN-OS 8.1 or earlier release to the log format introduced in PAN-OS 10.1.(Optional) After successful upgrade to PAN-OS 10.1, migrate the log format for logs generated in PAN-OS 8.1 and earlier releases.Skip this step if you do not need to preserve logs generated in PAN-OS 8.1 or earlier release or if there are no logs that need to be migrated.Migrating the log format is required to access logs generated in PAN-OS 8.1 and earlier releases after successful upgrade to PAN-OS 10.1. Logs generated in PAN-OS 8.1 or earlier release that are not migrated are automatically deleted.- Log in to the Panorama CLI of the Log Collector.Enter the CLI commands automatically displayed in the previous step to migrate logs.The commands displayed to migrate logs are dynamic and unique to each Log Collector.View the status of the log migration.admin> debug logdb migrate-lc statusRepeat for all Log Collectors you upgraded to PAN-OS 10.1Verify the software and content versions that are installed on each Log Collector.Log in to the Log Collector CLI and enter the show system info operational command. The output will resemble the following:
sw-version: 10.1.0 app-version: 8270-6076 app-release-date: 2020/05/08 18:21:51