Upgrade Panorama with an Internet Connection
Table of Contents
Expand all | Collapse all
- Upgrade Panorama with an Internet Connection
- Upgrade Panorama Without an Internet Connection
- Install Content Updates Automatically for Panorama without an Internet Connection
- Upgrade Panorama in an HA Configuration
- Migrate Panorama Logs to the New Log Format
- Upgrade Panorama for Increased Device Management Capacity
- Downgrade from Panorama 10.1
- Troubleshoot Your Panorama Upgrade
- What Updates Can Panorama Push to Other Devices?
- Schedule a Content Update Using Panorama
- Panorama, Log Collector, Firewall, and WildFire Version Compatibility
- Upgrade Log Collectors When Panorama Is Internet-Connected
- Upgrade Log Collectors When Panorama Is Not Internet-Connected
- Upgrade a WildFire Cluster from Panorama with an Internet Connection
- Upgrade a WildFire Cluster from Panorama without an Internet Connection
- Upgrade Firewalls When Panorama Is Internet-Connected
- Upgrade Firewalls When Panorama Is Not Internet-Connected
- Upgrade a ZTP Firewall
- Revert Content Updates from Panorama
- PAN-OS Upgrade Checklist
- Upgrade/Downgrade Considerations
- Troubleshoot Your PAN-OS Upgrade
- Upgrade the VM-Series PAN-OS Software (Standalone)
- Upgrade the VM-Series PAN-OS Software (HA Pair)
- Upgrade the VM-Series PAN-OS Software Using Panorama
- Upgrade the VM-Series Model
- Upgrade the VM-Series Model in an HA Pair
- Downgrade a VM-Series Firewall to a Previous Release
Upgrade Panorama with an Internet Connection
If Panorama™ has a direct connection to the internet, perform the following steps to install Panorama software and content updates as needed. If Panorama is running in a high availability (HA) configuration, upgrade the Panorama software on each peer (see Upgrade Panorama in an HA Configuration).
Upgrading the software on the Panorama virtual appliance does not change the system mode; switching to Panorama mode or Management Only mode is a manual task that requires additional settings as described when you Install the Panorama virtual appliance with a Local Log Collector.
PAN-OS 10.1 introduces a new log format. On upgrade from PAN-OS 10.0 to PAN-OS 10.1, you can choose to migrate logs generated in PAN-OS 8.1 or earlier release. Otherwise, these logs are automatically deleted on successful upgrade to PAN-OS 10.1. During migration, log data is not visible in the
Monitortabs. While the migration takes place, log data continues forwarding to the appropriate Log Collector but you may experience some impact to performance.
Palo Alto Networks introduced new log data formats at different points in your upgrade path depending on the PAN-OS version you are upgrading from.
- Upgrade from PAN-OS 8.1 to PAN-OS 9.0—PAN-OS 9.0 introduced a new log data format for local and Dedicated Log Collectors. On your upgrade path to PAN-OS 10.1, existing log data is automatically migrated to the new format when you upgrade from PAN-OS 8.1 to PAN-OS 9.0.
- Upgrade from PAN-OS 10.0 to PAN-OS 10.1—PAN-OS 10.1 introduced a new log format for local and Dedicated Log Collectors. On upgrade to PAN-OS 10.1, logs generated in PAN-OS 8.1 or earlier are no longer available. This includes logs migrated as part of the upgrade to PAN-OS 9.0. After upgrade to PAN-OS 10.1, you have the option to recover and migrate these logs to the PAN-OS 10.1 log format.
You must upgrade all Log Collectors in a collector group in the same change window to avoid losing log data loss. No log forwarding or log collection occurs if the Log Collectors in a collector group are not all running the same PAN-OS version. Additionally, the log data for the Log Collectors in the collector group is not visible in the
Monitortabs until all Log Collectors are running the same PAN-OS version. For example, if you have three Log Collectors in a collector group and you upgrade two of the Log Collectors, then no logs are forwarded to any Log Collectors in the collector group.
Before upgrading Panorama, refer to the Release Notes for the minimum content release version required for PAN-OS 10.1.
- Verify that the updates you plan to install are appropriate for your Panorama deployment.Palo Alto Networks highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version.
- You cannot skip the installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 10.1
- (Panorama Interconnect plugin only) Synchronize the Panorama Node with the Panorama Controller.Before you begin upgrading a Panorama Node, you must synchronize the Panorama Controller and Panorama Node configuration. This is required to successfully push the common Panorama Controller configuration to your Panorama Node after successful upgrade.
- Save a backup of the current Panorama configuration file that you can use to restore the configuration if you have problems with the upgrade.Although Panorama automatically creates a backup of the configuration, best practice is to create and externally store a backup before you upgrade.
- Save named Panorama configuration snapshot(), enter aPanoramaSetupOperationsNamefor the configuration, and clickOK.
- Export named Panorama configuration snapshot, select theNameof the configuration you just saved, clickOK, and save the exported file to a location that is external to Panorama.
- (Best Practices) If you are leveraging Cortex Data Lake (CDL), install the Panorama device certificate.Panorama automatically switches to using the device certificate for authentication with CDL ingestion and query endpoints on upgrade to PAN-OS 10.1.If you do not install the device certificate prior to upgrade to PAN-OS 10.1, Panorama continues to use the existing logging service certificate for authentication.
- Install the latest content updates.If Panorama is not running the minimum content versions required for the Panorama release to which you intend to upgrade, you must update content versions to the minimum (or later) versions before you install the software updates. Refer to Release Notes for minimum content release version for a Panorama release.Palo Alto Networks® highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version. Additionally, we recommend that you schedule automatic, recurring updates so that you are always running the latest content versions (refer to 12).
- SelectandPanoramaDynamic UpdatesCheck Nowfor the latest updates. If the value in the Action column isDownload, an update is available.Ensure that Panorama is running the same but not a later content release version than is running on managed firewalls and Log Collectors.
- (Before you update the content release version on Panorama, be sure to upgrade managed firewalls and then Log Collectors (see Upgrade Log Collectors When Panorama Is Internet-Connected) to the same (or a later) content release version.If you do not need to install content updates at this time, then skip ahead to the next step.
- Install remaining content updates, as needed. When installed, the Currently Installed column displays a check mark.
- DownloadandInstallthe Applications or Applications and Threats update. Regardless of your subscription, Panorama installs and needs only the Applications content update, not the Threats content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
- DownloadandInstallother updates (Antivirus, WildFire®, or URL Filtering) as needed, one at a time, and in any sequence.
- Upgrade Panorama to the PAN-OS releases along your upgrade path to PAN-OS 10.1.
- Upgrade Panorama with an Internet Connection to PAN-OS 8.1.
- Upgrade Panorama with an Internet Connection to PAN-OS 9.0.PAN-OS 9.0 introduced a new log format. If a local Log Collector is configured, logs are automatically migrated to the new format after you successfully upgrade Panorama to PAN-OS 9.0.Do not continue on your upgrade path until you verify the automatic log migration completed successfully.
- Upgrade Panorama with an Internet Connection to PAN-OS 9.1.
- Upgrade Panorama with an Internet Connection to PAN-OS 10.0.(Panorama in Legacy mode only)DownloadPAN-OS 10.0.0 and thenDownloadandInstallPAN-OS 10.0.8 or later release before you continue on your upgrade path.This is required to preserve all logs stored on the NFS storage partition. Some logs stored on the NFS storage partition of a Panorama in Legacy mode are deleted if you install PAN-OS 10.0.7 or earlier PAN-OS 10.0 release.
- Upgrade Panorama to PAN-OS 10.1.
- Check Now() for the latest releases. If a software release is available, the Action column displaysPanoramaSoftwareDownload.
- Locate andDownloadthe PAN-OS 10.1.0 image. After a successful download, the Action column changes fromDownloadtoInstallfor the downloaded image.(Panorama in Legacy mode only)Downloadthe PAN-OS 10.1.0 image and thenDownloadthe PAN-OS 10.1.3 or later release image.This is required to preserve all logs stored on the NFS storage partition. Some logs stored on the NFS storage partition of a Panorama in Legacy mode are deleted if you install PAN-OS 10.1.2 or earlier PAN-OS 10.1 release.
- Install the downloaded image and then reboot.
- Installthe image.(Panorama in Legacy mode only)Installthe PAN-OS 10.1.3 or later release image only.
- After the installation completes successfully, reboot using one of the following methods:
- If prompted to reboot, clickYes. If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the username and password you specified during initial configuration.
- If you are not prompted to reboot,Reboot Panoramafrom the Device Operations section ().PanoramaSetupOperations
- (Logs generated in PAN-OS 8.1 or earlier releases only) If the Log Collector stores logs generated in PAN-OS 8.1 or earlier release, the upgrade to PAN-OS 10.1 an alert is displayed notifying you that logs generated in PAN-OS 8.1 or earlier release were detected and are no longer available after upgrade to PAN-OS 10.1.This alert provides the exact CLI commands required to migrate and recover logs generated in PAN-OS 8.1 or earlier release after successful upgrade to PAN-OS 10.1. Save these CLI commands if you want to recover the logs generated while running PAN-OS 8.1 and earlier release.Acknowledge the notification andInstallPAN-OS 10.1 again.
- (Optional for Logs generated in PAN-OS 8.1 or earlier releases only) After successful upgrade to PAN-OS 10.1, migrate and recover logs generated in PAN-OS 8.1 and earlier releases.If you choose to not migrate and recover logs generated in PAN-OS 8.1 and earlier releases, they are deleted and are no longer available. Migrating the log format is required to recover logs generated in PAN-OS 8.1 and earlier releases after successful upgrade to PAN-OS 10.1.Skip this step if you do not need to preserve logs generated in PAN-OS 8.1 or earlier release or if there are no logs that need to be migrated.
- Log in to the Panorama CLI of the Log Collector.
- Enter the CLI commands automatically displayed in the previous step to migrate logs.The commands displayed to migrate logs are dynamic and unique to each Log Collector.
- View the status of the log migration.admin>debug logdb migrate-lc statusDo not reboot or otherwise power off the Log Collector until the log migration is complete. Disrupting the log migration may result in log loss.
- (If local Log Collector is in a Collector Group) Upgrade the remaining Log Collectors in the Collector Group.
- (Optional) Selectto edit the Logging and Reporting Setting and disablePanoramaSetupManagementUse Panorama Data for Pre-Defined Reports.On upgrade to PAN-OS 10.1, theUse Panorama Data for Pre-Defined Reportssetting is enabled by default. This causes log collectors to be the data source for pre-defined reports rather your managed firewalls.When enabled, this will cause pre-defined reports to generate with no data if you have managed firewalls that are generating pre-defined reports but are not forwarding logs to log collectors. This change in default behavior has no impact on pre-defined report generation if your managed firewalls are forwarding logs to your log collectors.
- (Best Practice) Schedule recurring, automatic content updates.Panorama does not synchronize content update schedules across HA peers. You must perform this task on both the active and passive Panorama.In the header row for each update type (), thePanoramaDynamic UpdatesScheduleis initially set toNone. Perform the following steps for each update type.
- ClickNoneand select the update frequency (Recurrence). The frequency options depend on the update type.
- Select the schedule action:
- Download And Install(Best Practice)—Panorama automatically installs updates after downloading them.
- Download Only—You must manually install updates after Panorama downloads them.
- Based on the best practices for the security posture of your organization, configure a delay (Threshold) after an update becomes available before Panorama downloads the update.
- ClickOKto save your changes.
- SelectandCommitCommit to PanoramaCommityour changes.