Upgrade Firewalls When Panorama Is Internet-Connected

Log in to the Panorama web interface.
Modified your Security policy rule to allow
ssl
application traffic.
This is required to prevent managed devices disconnecting from Panorama after upgrade to PAN-OS 10.2 if traffic between Panorama and managed devices is controlled using the
panorama
App-ID. Managed devices will disconnect from Panorama if the
ssl
application is not allowed before you upgrade.
PAN-OS 10.2 uses TLS version 1.3 to encrypt the service certificate and handshake messages between Panorama and managed firewalls. As a result, the App-ID for traffic from managed firewalls to Panorama is reclassified from
panorama
to
ssl
. To continue communication between Panorama and managed devices, you must modify the Security policy rule controlling traffic between Panorama and managed devices to also allow the
ssl
application.
Skip this step if the Security policy rule controlling traffic between Panorama and managed devices allows
Any
application or if you already modified your Security policy rule controlling traffic between Panorama and managed devices.
Select
Policies
Security
Pre Rules
.
Select
Device Group
containing the Security policy rule controlling traffic between Panorama and managed firewalls.
Select the Security policy rule.
Select
Application
and
Add
the
ssl
.
Do not delete the
panorama
application. This will cause all managed firewalls to disconnect from Panorama after you push the changes.

Click
OK
.
Select
Commit
Commit and Push
and
Commit and Push
your configuration changes.
Save a backup of the current configuration file on each managed firewall you plan to upgrade.
Although the firewall automatically creates a configuration backup, it is a best practice to create and externally store a backup before you upgrade.
Select
Panorama
Setup
Operations
and click
Export Panorama and devices config bundle
to generate and export the latest configuration backup of Panorama and of each managed appliance.

Save the exported file to a location external to the firewall. You can use this backup to restore the configuration if you have problems with the upgrade.
Update the content release version on the firewalls you plan to upgrade.
Refer to the Release Notes for the minimum content release version required for PAN-OS 10.2. Make sure to follow the Best Practices for Applications and Threats Content Updates when deploying content updates to Panorama and managed firewalls.
Select
Panorama
Device Deployment
Dynamic Updates
and
Check Now
for the latest updates. If an update is available, the Action column displays a
Download
link.

If not already installed,
Download
the latest content release version.
Click
Install
, select the firewalls on which you want to install the update, and click
OK
. If you are upgrading HA firewalls, you must update content on both peers.

By default, you can upload a maximum of two software or content updates of each type to a Panorama appliance and if you download a third update of the same type, Panorama will delete the update for the earliest version of that type. If you need to upload more than two software updates or content updates of a single type, use the
setmax-num-images count <number>
CLI command to increase the maximum.
Determine the Upgrade Path to PAN-OS 10.2.
You cannot skip installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 10.2.0.
Review the PAN-OS Upgrade Checklist, the known issues and changes to default behavior in the Release Notes and upgrade/downgrade considerations for each release through which you pass as part of your upgrade path.
If upgrading more than one firewall, streamline the process by determining upgrade paths for all firewalls before you start downloading images.
(
Best Practices
) If you are leveraging Cortex Data Lake (CDL), install the device certificate.
The firewall automatically switches to using the device certificate for authentication with CDL ingestion and query endpoints on upgrade to PAN-OS 10.2.
If you do not install the device certificate prior to upgrade to PAN-OS 10.2, the firewall continues to use the existing logging service certificates for authentication.
(HA firewall upgrades only)
If you will be upgrading firewalls that are part of an HA pair, disable preemption. You need only disable this setting on one firewall in each HA pair.
Log in to the firewall web interface of one of the firewall HA peers.
Select
Device
High Availability
and edit the
Election Settings
.
If enabled, disable (clear) the
Preemptive
setting and click
OK
.

Commit
your change. Make sure the commit is successful before you proceed with the upgrade.
(
HA firewall upgrades only
) Suspend the primary HA peer to force a failover.
(
Active/passive firewalls
) For firewalls in an active/passive HA configuration, suspend and upgrade the active HA peer first.
(
Active/active firewalls
) For firewalls in an active/active HA configuration, suspend and upgrade the active-primary HA peer first.
Log in to the firewall web interface of active primary firewall HA peer.
Select
Device
High Availability
Operational Commands
and
Suspend local device for high availability
.
In the bottom-right corner, verify that the state is
suspended
.
The resulting failover should cause the secondary passive HA peer to transition to
active
state.
The resulting failover verifies that HA failover is functioning properly before you upgrade.
Download the target PAN-OS 10.2.0 release image.
Select
Panorama
Device Deployment
Software
and
Check Now
for the latest release versions.
Download
the firewall-specific file (or files) for the release version to which you are upgrading. You must download a separate installation file for each firewall model (or firewall series) that you intend to upgrade.
For example, to upgrade your PA-220 and PA-5250 firewalls to PAN-OS 10.2.0, download the
PanOS_220-10.2.0
,
PanOS_3000-10.2.0
, and
PanOS_5200-10.2.0
images. After you successfully download an image, the Action column changes to
Install
for that image.
Install the PAN-OS 10.2 software update on the firewalls.
(
SD-WAN only
) To preserve an accurate status for your SD-WAN links, you must upgrade your hub firewalls to PAN-OS 10.2 before you upgrade your branch firewalls. Upgrading branch firewalls before hub firewalls may result in incorrect monitoring data (
Panorama
SD-WAN
Monitoring
) and for SD-WAN links to erroneously display as
down
.
Click
Install
in the Action column that corresponds to the firewall models you want to upgrade. For example, if you want to upgrade your PA-220 firewalls, click
Install
in the row that corresponds to PanOS_220-10.2.0.
In the Deploy Software file dialog, select all firewalls that you want to upgrade.
(
HA firewall upgrades only
) To reduce downtime, select only one peer in each HA pair. For active/passive pairs, select the passive peer; for active/active pairs, select the active-secondary peer.
(HA firewall upgrades only)
Make sure
Group HA Peers
is not selected.
Select
Reboot device after install
.
To begin the upgrade, click
OK
.
After the installation completes successfully, reboot using one of the following methods:
If you are prompted to reboot, click
Yes
.
If you are not prompted to reboot, select
Device
Setup
Operations
and
Reboot Device
.
After the firewalls finish rebooting, select
Panorama
Managed Devices
and verify the Software Version is 10.2.0 for the firewalls you upgraded. Also verify that the HA status of any passive firewalls you upgraded is still passive.
(
HA firewall upgrades only
) Restore HA functionality to the primary HA peer.
Log in to the firewall web interface of suspended primary firewall HA peer.
Select
Device
High Availability
Operational Commands
and
Make local device functional for high availability
.
In the bottom-right corner, verify that the state is
Passive
. For firewalls in an active/active configuration, verify that the state is
Active
.
Wait for the HA peer running configuration to synchronize.
In the
Dashboard
, monitor the Running Config status in the High Availability widget.
(
HA firewall upgrades only
) Suspend the secondary HA peer to force a failover back to the primary HA peer.
Log in to the firewall web interface of active secondary firewall HA peer.
Select
Device
High Availability
Operational Commands
and
Suspend local device for high availability
.
In the bottom-right corner, verify that the state is
suspended
.
The resulting failover should cause the primary passive HA peer to transition to
active
state.
The resulting failover verifies that HA failover is functioning properly before you upgrade.
(HA firewall upgrades only)
Upgrade the second HA peer in each HA pair.
In the Panorama web interface, select
Panorama
Device Deployment
Software
.
Click
Install
in the Action column that corresponds to the firewall models of the HA pairs you are upgrading.
In the Deploy Software file dialog, select all firewalls that you want to upgrade. This time, select only the peers of the HA firewalls you just upgraded.
Make sure
Group HA Peers
is not selected.
Select
Reboot device after install
.
To begin the upgrade, click
OK
.
After the installation completes successfully, reboot using one of the following methods:
If you are prompted to reboot, click
Yes
.
If you are not prompted to reboot, select
Device
Setup
Operations
and
Reboot Device
.
(
HA firewall upgrades only
) Restore HA functionality to the secondary HA peer.
Log in to the firewall web interface of suspended secondary firewall HA peer.
Select
Device
High Availability
Operational Commands
and
Make local device functional for high availability
.
In the bottom-right corner, verify that the state is
Passive
. For firewalls in an active/active configuration, verify that the state is
Active
.
Wait for the HA peer running configuration to synchronize.
In the
Dashboard
, monitor the Running Config status in the High Availability widget.
(
FIPS-CC mode only
) Upgrade Panorama and Managed Devices in FIPS-CC Mode.
Upgrading a managed firewall in FIPS-CC mode requires you to reset the secure connection status if you added the Dedicated Log Collector to Panorama management while the managed firewall was running a PAN-OS 10.2 release.
You do not need to re-onboard the managed firewall added to Panorama management while the managed firewall was running a PAN-OS 10.0 or earlier release.
Verify the software and content release version running on each managed firewall.
On Panorama, select

Panorama

Managed Devices

.

Locate the firewalls and review the content and software versions in the table.

For HA firewalls, you can also verify that the HA Status of each peer is as expected.


(HA firewall upgrades only)
If you disabled preemption on one of your HA firewalls before you upgraded, then edit the
Election Settings
(
Device
High Availability
) and re-enable the
Preemptive
setting for that firewall and then
Commit
the change.
On the Panorama web interface, perform a full configuration push to your managed firewalls.
This step is required to enable selective commit and push of device group and template stack configuration changes from Panorama to your managed firewalls.
This is required to successfully push configuration changes to multi-vsys firewalls managed by Panorama after successful upgrade to PAN-OS 10.2. For more information, see the change to default behavior for shared configuration objects for multi-vsys firewalls managed by Panorama.
Select
Commit
Push to Devices
.
Push
.