Upgrade Panorama Without an Internet Connection
If Panorama™ does not have a direct connection to the internet, perform the following steps to install Panorama software and content updates as needed. If Panorama is deployed in a high availability (HA) configuration, you must upgrade each peer (see Upgrade Panorama in an HA Configuration).
Upgrading the software on the Panorama virtual appliance does not change the system mode; switching to Panorama mode or Management Only mode is a manual task that requires additional settings as described when you Set Up the Panorama Virtual Appliance with a Local Log Collector.
PAN-OS 10.1 introduces a new log format. On upgrade from PAN-OS 10.0 to PAN-OS 10.1, you can choose to migrate logs generated in PAN-OS 8.1 or earlier release. Otherwise, these logs are automatically deleted on successful upgrade to PAN-OS 10.1. During migration, log data is not visible in the
Monitortabs. While the migration takes place, log data continues forwarding to the appropriate Log Collector but you may experience some impact to performance.
If you are upgrading from PAN-OS 8.1, PAN-OS® 9.0 introduced a new log data format for local and Dedicated Log Collectors. On your upgrade path to PAN-OS 10.1, existing log data is automatically migrated to the new format when you upgrade from PAN-OS 8.1 to PAN-OS 9.0.
You must upgrade all Log Collectors in a collector group at the same time to avoid losing log data loss. No log forwarding or log collection occurs if the Log Collectors in a collector group are not all running the same PAN-OS version. Additionally, the log data for the Log Collectors in the collector group is not visible in the
Monitortabs until all Log Collectors are running the same PAN-OS version. For example, if you have three Log Collectors in a collector group and you upgrade two of the Log Collectors, then no logs are forwarded to any Log Collectors in the collector group.
Before you upgrade Panorama, refer to the Release Notes for the minimum content release version required for PAN-OS® 10.1.
For Panorama on Azure, you must perform additional steps before you can successfully upgrade the software version. To upgrade, you need to export the Panorama configuration, upgrade the content and software versions, and import the configuration to the Panorama management server after you successfully upgrade.
- Verify that the updates you plan to install are appropriate for your Panorama deployment.Palo Alto Networks highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version.
- You cannot skip the installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 10.1
- Save a backup of the current Panorama configuration file that you can use to restore the configuration if you have problems with the upgrade.Although Panorama automatically creates a backup of the configuration, best practice is to create and externally store a backup before you upgrade.
- Save named Panorama configuration snapshot(), enter aPanoramaSetupOperationsNamefor the configuration, and clickOK.
- Export named Panorama configuration snapshot, select theNameof the configuration you just saved, clickOK, and save the exported file to a location that is external to Panorama.
- Download the latest content updates to a host that can connect and upload content to Panorama either over SCP or HTTPS.
- Use a host that has internet access to log in to the Palo Alto Networks Customer Support website.
- Download content updates as needed:
- Clickin the Resources section.UpdatesDynamic Updates
- Downloadthe appropriate content updates and save the files to the host. Perform this step for each content type you need to update.
- Install the latest content updates.Install the Applications or Applications and Threats update first, and then install any other updates (Antivirus, WildFire®, and URL Filtering), one at a time, and in any sequence.Regardless whether your subscription includes both Applications and Threats content, Panorama installs and needs only the Applications content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.Log in to the Panorama web interface and perform the following steps for each content type:
- Select.PanoramaDynamic Updates
- ClickUpload, select the contentType,Browseto the location on the host to which you downloaded the update, select the update, and clickOK.
- Install From File, select thePackage Type, and clickOK.
- Upgrade Panorama to the PAN-OS releases along your upgrade path to PAN-OS 10.1.
- Upgrade Panorama When Not Internet Connected to PAN-OS 8.1.
- Upgrade Panorama When Not Internet Connected to PAN-OS 9.0.PAN-OS 9.0 introduced a new log format. If a local Log Collector is configured, logs are automatically migrated to the new format after you successfully upgrade Panorama to PAN-OS 9.0.Do not continue on your upgrade path until you verify the automatic log migration completed successfully.
- Upgrade Panorama When Not Internet Connected to PAN-OS 9.1.
- Upgrade Panorama When Not Internet Connected to PAN-OS 10.0.(Panorama in Legacy mode only)DownloadPAN-OS 10.0.0 and thenDownloadandInstallPAN-OS 10.0.8 or later release before you continue on your upgrade path.This is required to preserve all logs stored on the NFS storage partition. Some logs stored on the NFS storage partition of a Panorama in Legacy mode are deleted if you install PAN-OS 10.0.7 or earlier PAN-OS 10.0 release.
- Download the latest PAN-OS 10.1 release image to a host that can connect and upload content to Panorama either over SCP or HTTPS.
- Use a host with internet access to log in to the Palo Alto Networks Customer Support web site.
- Download software updates:
- On the main page of Palo Alto Networks Customer Support website, click.UpdatesSoftware Updates
- Locate the model-specific for the latest PAN-OS 10.1 release image. For example, to upgrade an M-Series appliance to Panorama 10.1.0, download thePanorama_m-10.1.0image; to upgrade a Panorama virtual appliance to Panorama 10.1.0, download thePanorama_pc-10.1.0image.You can quickly locate Panorama images by selectingPanorama M Images(M-Series appliances) orPanorama Updates(virtual appliances) from theFilter Bydrop-down.(Panorama in Legacy mode only)Downloadthe PAN-OS 10.1.0 image and the PAN-OS 10.1.3 or later release image.This is required to preserve all logs stored on the NFS storage partition. Some logs stored on the NFS storage partition of a Panorama in Legacy mode are deleted if you install PAN-OS 10.1.2 or earlier PAN-OS 10.1 release.
- Click the filename and save the file to the host.
- Upgrade Panorama to PAN-OS 10.1.
- SelectandPanoramaSoftwareUploadthe PAN-OS 10.1 image you downloaded in the previous step.(Panorama in Legacy mode only)Uploadboth the PAN-OS 10.1.0 image and PAN-OS 10.1.3 or later release image.
- Browseto the location on the host to which you downloaded the update, select the update,Sync To Peerif Panorama is in an HA configuration (to push the software image to the secondary peer), and clickOK.
- Install the software image and reboot.For an HA configuration, Upgrade Panorama in an HA Configuration; otherwise:
- Installthe uploaded image.(Panorama in Legacy mode only)Installthe PAN-OS 10.1.3 or later release image only.
- After you successfully complete the installation, reboot using one of the following methods:
- If prompted to reboot, clickYes. If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the username and password you specified during initial configuration.
- If you are not prompted to reboot,Reboot Panoramafrom the Device Operations section ().PanoramaSetupOperations
- (Logs generated in PAN-OS 8.1 or earlier releases only) If the Log Collector stores logs generated in PAN-OS 8.1 or earlier release, the upgrade to PAN-OS 10.1 is blocked to alert you that logs generated in PAN-OS 8.1 or earlier release are automatically deleted on upgrade to PAN-OS 10.1.Acknowledge the notification andInstallPAN-OS 10.1 again.After successful upgrade to PAN-OS 10.1, CLI commands are provided to recover and migrate all logs generated in PAN-OS 8.1 or earlier release to the log format introduced in PAN-OS 10.1.
- (If Local Log Collector configured) After successful upgrade to PAN-OS 10.1, migrate the log format for logs generated in PAN-OS 8.1 and earlier releases or delete the logs.Migrating the log format is required to access logs generated in PAN-OS 8.1 and earlier releases after successful upgrade to PAN-OS 10.1. Logs generated in PAN-OS 8.1 or earlier release that are not migrated are automatically deletedSkip this step if you do not need to preserve logs generated in PAN-OS 8.1 or earlier release or if there are no logs that need to be migrated.
- Log in to the Panorama CLI of the Log Collector.
- Enter the CLI commands automatically displayed in the previous step to migrate logs.The commands displayed to migrate logs are dynamic and unique to each Log Collector.
- View the status of the log migration.admin>debug logdb migrate-lc status
- (Panorama on Azure only) Load the exported Panorama configuration from Step 2.
- Import named Panorama configuration snapshot(),PanoramaSetupOperationsBrowseand select the Panorama configuration file, and clickOK.
- Load named Panorama configuration snapshot, select theNameof the configuration you just imported, enter theDecryption Keyif required and clickOK.
- Commit the Panorama configuration by enter the following commands:admin>configureadmin>commit force
- (If local Log Collector is in a Collector Group) Upgrade the remaining Log Collectors in the Collector Group.
Recommended For You
Recommended videos not found.