Downgrade from Panorama 10.1
Procedure on how to downgrade from Panorama 10.1 to Panorama 10.0.
PAN-OS® 10.1 introduces enhanced features such as enhanced authentication that enables you to add new firewalls to Panorama management, as well as the ability to schedule configuration pushes to managed firewalls, to configure a unique master key for Panorama and managed firewalls, to perform audit tracking for administrator activity on Panorama and managed firewalls, and the ability for Panorama to preserve uncommitted configuration changes when an unexpected restart occurs. However, these features are not compatible with Panorama appliances running PAN-OS 10.0 or earlier releases. Use the following workflow to downgrade firewalls before you downgrade Log Collectors and Panorama running a PAN-OS 10.1 release to an earlier feature release. This procedure works both for Panorama when managing a local Log Collector and for Panorama when managing one or more Dedicated Log Collectors.
All existing logs are lost after downgrade to PAN-OS 10.0. This means that all logs ingested while running PAN-OS 10.1 are not visible after downgrade to PAN-OS 10.0. Additionally, logs ingested while running PAN-OS 10.1 cannot be retrieved by migrating the raw logs forwarded from the managed firewall to the Log Collector before they are ingested by the Log Collector.
However, you can recover logs ingested while running PAN-OS 10.0, 9.1, or 9.0 by from the Log Collector CLI after successful downgrade. Logs must be recovered on each Log Collector downgraded to PAN-OS 10.0.
Review the Palo Alto Networks Compatibility Matrix to confirm that the firewalls and appliances you intend to downgrade are compatible with the PAN-OS version to which you intend to downgrade. For the firewalls and appliances that you can downgrade, you should also review the Upgrade/Downgrade Considerations to ensure that you account for all features and configuration settings that will be different or unavailable after you downgrade.
- Save a backup of the configuration files for Panorama and managed devices.
- Export Panorama and device configuration snapshot().PanoramaSetupOperations
- Save the exported .tgz file to a location external to Panorama, Log Collectors, and firewalls. You can use this backup to restore the configuration if you experience problems that cause you to start over.
- If you have configured authentication for a Dedicated Log Collector and removed theadminadministrator, configure and push a newadminuser to your Dedicated Log Collectors.Dedicated Log Collectors must have theadminuser configured in order to downgrade to PAN-OS 9.1 and earlier releases.
- Downgrade each firewall running a PAN-OS 10.1 version.If downgrading more than one firewall, streamline the process by having each firewall-specific PAN-OS 10.0 image downloaded to Panorama before you start downgrading. For example, to downgrade your PA-220 firewall to PAN-OS 10.0.0, download thePanOS_220-10.0.0orPanOS_3000-10.0.0images.Panorama requires that all firewalls are running the same or an earlier PAN-OS release. So before you downgrade Panorama, use and repeat the appropriate tasks below according to your environment to downgrade all managed firewalls as needed:
Non-HA FirewallInstall(Action column) the appropriate PAN-OS 10.0 version, select all the firewalls you intend to downgrade, selectReboot device after install, and clickOK.Active/Active HA Firewalls
- Check Nowfor available images ().PanoramaDevice DeploymentSoftware
- Locate the PAN-OS 10.0 image for each model or series of firewalls you intend to downgrade. If the image is not already downloaded, thenDownloadit.
Active/Passive HA FirewallsIn this example, the active firewall is named fw1 and the passive firewall is named fw2:
- ClickInstall, disable (clear)Group HA Peers, select either of the HA peers, selectReboot device after install, and clickOK. Wait for the firewall to finish rebooting before you proceed.
- ClickInstall, disable (clear)Group HA Peers, select the HA peer that you didn’t update in the previous step, selectReboot device after install, and clickOK.
- Install(Action column) the appropriate update, disable (clear)Group HA Peers, select fw2, selectReboot device after install, and clickOK.
- After fw2 finishes rebooting, verify fw1 (widget) is still the active peer and that fw2 is still the passive peer (the Local firewall state isDashboardHigh Availabilityactiveand the Peer—fw2—ispassive).
- Access fw1 andSuspend local device().DeviceHigh AvailabilityOperational Commands
- Access fw2 () and verify that the Local firewall state isDashboardHigh Availabilityactiveand the Peer firewall—fw1—issuspended.
- Access Panorama, select,PanoramaDevice DeploymentSoftwareInstall(Action column) the appropriate update, disable (clear)Group HA Peers, select fw1, selectReboot device after install, and clickOK. Wait for fw1 to finish rebooting before you proceed.
- Access fw1 (widget) and verify that the Local firewall state isDashboardHigh Availabilitypassiveand the Peer—fw2—isactive.If you enabled preemption in the Election settings (), then fw1 will be reinstated as the active peer after reboot.DeviceHigh AvailabilityGeneral
- Downgrade each Log Collector running PAN-OS 10.1.
- Check Nowfor available images ().PanoramaDevice DeploymentSoftware
- Locate the appropriate PAN-OS 10.0 image for your Panorama appliance. If the image is not already downloaded, thenDownloadit (Action column).Palo Alto Networks requires downgrading your Log Collectors to PAN-OS 10.0.8 or later PAN-OS 10.0 release.
- After the download is complete,Installthe image on each Log Collector running PAN-OS 10.1. SelectReboot device after installto automatically reboot the appliance when the upgrade is complete.
- Downgrade Panorama.
- SelectandPanoramaSoftwareCheck Nowfor available images.
- Locate the appropriate PAN-OS 10.0 image for your Panorama appliance. If the image is not already downloaded, thenDownloadit.
- After the download is complete,Installthe image on your Panorama appliance.
- Reboot Panorama as follows:
- If you are prompted to reboot, clickYes. If you see aCMS Loginprompt, press Enter without typing the username or password. When the Panorama login prompt appears, enter the username and password you set during initial configuration.
- If you are not prompted to reboot, selectand clickPanoramaSetupOperationsReboot Panorama(Device Operations).
- Recover logs ingested while running PAN-OS 10.0, 9.1, and 9.0.All existing logs are lost after successful downgrade to PAN-OS 10.0. However, you can recover logs ingested by the Log Collector while it was running PAN-OS 10.0, 9.1, or 9.0. Logs ingested while running PAN-OS 10.1 are not recoverable.Repeat this step for all Log Collectors downgraded to PAN-OS 10.0.
- Recover your logs.admin>debug logdb migrate-lc start log-type all time period start-date <date> end-date <date>Thestart-dateandend-datespecify the set of logs that are recovered. The command recovers logs ingested within the specified date range and while the Log Collector was running PAN-OS 10.0, 9.1, or 9.0.
Recommended For You
Recommended videos not found.