Downgrade from Panorama 10.2
Table of Contents
10.2
Expand all | Collapse all
-
-
- Upgrade Panorama with an Internet Connection
- Upgrade Panorama Without an Internet Connection
- Install Content Updates Automatically for Panorama without an Internet Connection
- Upgrade Panorama in an HA Configuration
- Migrate Panorama Logs to the New Log Format
- Upgrade Panorama for Increased Device Management Capacity
- Upgrade Panorama and Managed Devices in FIPS-CC Mode
- Downgrade from Panorama 10.2
- Troubleshoot Your Panorama Upgrade
-
- What Updates Can Panorama Push to Other Devices?
- Schedule a Content Update Using Panorama
- Panorama, Log Collector, Firewall, and WildFire Version Compatibility
- Upgrade Log Collectors When Panorama Is Internet-Connected
- Upgrade Log Collectors When Panorama Is Not Internet-Connected
- Upgrade a WildFire Cluster from Panorama with an Internet Connection
- Upgrade a WildFire Cluster from Panorama without an Internet Connection
- Upgrade Firewalls When Panorama Is Internet-Connected
- Upgrade Firewalls When Panorama Is Not Internet-Connected
- Upgrade a ZTP Firewall
- Revert Content Updates from Panorama
-
Downgrade from Panorama 10.2
Procedure on how to downgrade from Panorama 10.2 to Panorama 10.1.
PAN-OS® 10.2 introduces advanced threat prevention
to detect and prevent the latest advanced threats, advanced URL
filtering to analyze suspicious web page content in real-time, an
advanced routing engine that uses an industry-standard configuration
methodology, simplified software upgrade for Panorama and managed
devices to reduce the operational burden of upgrading managed devices
across multiple PAN-OS releases, improved Log Collector health status
monitoring, automatic content pushes for VM-Series and CN-Series
firewalls managed by Panorama to reduce the operational overhead
required to generate images with the latest content updates, and
administrator-level push to selectively push configuration changes
to managed firewalls. These features are not compatible with Panorama
running PAN-OS 10.2 or earlier release. Use the following workflow to
downgrade firewalls before you downgrade Log Collectors and Panorama
running a Panorama 10.2 release to an earlier feature release. This
procedure works both for Panorama when managing a local Log Collector
and for Panorama when managing one or more Dedicated Log Collectors.
To
downgrade from PAN-OS 10.2 to an earlier PAN-OS release, you must
download and install PAN-OS 10.1.3 or a later PAN-OS 10.1 release
before you can continue on your downgrade path to your target PAN-OS
release. Downgrade from PAN-OS 10.2 fails if you attempt to downgrade
to PAN-OS 10.1.2 or an earlier PAN-OS 10.2 release.
Review the Palo Alto Networks Compatibility Matrix to
confirm that the firewalls and appliances you intend to downgrade are
compatible with the PAN-OS release to which you intend to downgrade.
For the firewalls and appliances that you can downgrade, you should
also review the Upgrade/Downgrade Considerations to ensure
that you account for all features and configuration settings that
will be different or unavailable after you downgrade.
- Log in to the Panorama web interface.
- Save a backup of the configuration files for Panorama
and managed devices.
- Export Panorama and device configuration snapshot (PanoramaSetupOperations).
- Save the exported .tgz file to a location external to Panorama, Log Collectors, and firewalls. You can use this backup to restore the configuration if you experience problems that cause you to start over.
- If you have configured authentication for
a Dedicated Log Collector and removed the admin administrator,
configure and push a new admin user
to your Dedicated Log Collectors.Dedicated Log Collectors must have the admin user configured in order to downgrade to PAN-OS 9.1 and earlier releases.
- Select PanoramaPlugins and Download the plugin
version supported on PAN-OS 10.2 for all plugins currently installed
on Panorama.See the Panorama Plugins Compatibility Matrix for the Panorama plugin version supported on PAN-OS 10.2 and earlier releases.This is required to successfully downgrade Panorama from PAN-OS 10.2 to PAN-OS 10.2 and earlier releases. The downloaded plugin version is automatically installed during downgrade to PAN-OS 10.1. Downgrade to PAN-OS 10.2 is blocked if the supported plugin version is not downloaded.(ZTP plugin only) To successfully downgrade Panorama to PAN-OS 10.1, you must uninstall the ZTP plugin before you begin the downgrade process. After successful downgrade to PAN-OS 10.2, you must reinstall the ZTP plugin on Panorama.
- Downgrade each firewall running a PAN-OS 10.2 release.Downgrading from PAN-OS 10.2 to a previous feature release requires that you first downgrade to PAN-OS 10.1.3 or later PAN-OS 10.1 release. After successfully downgrading to PAN-OS 10.1.3 or later PAN-OS 10.1 release, you can continue downgrading to your target PAN-OS version.If downgrading more than one firewall, streamline the process by having each firewall-specific PAN-OS 10.2 image downloaded to Panorama before you start downgrading. For example, to downgrade your PA-220 firewall to PAN-OS 10.1., download the PanOS_220-10.1.0 or PanOS_3000-10.1.0 images.Panorama requires that all firewalls are running the same or an earlier PAN-OS release. So before you downgrade Panorama, use and repeat the appropriate tasks below according to your environment to downgrade all managed firewalls as needed:
- Check Now for
available images (PanoramaDevice DeploymentSoftware).(PAN-OS 10.2.10 and later 10.2 releases) By default, the preferred releases and the corresponding base releases are displayed. To view the preferred releases only, disable (clear) the Base Releases checkbox. Similarly, to view the base releases only, disable (clear) the Preferred Releases checkbox.
- Locate the PAN-OS 10.2 image for each model or series of firewalls you intend to downgrade. If the image is not already downloaded, then Download it.
Non-HA FirewallInstall (Action column) the appropriate PAN-OS 10.2 version, select all the firewalls you intend to downgrade, select Reboot device after install, and click OK.Active/Active HA Firewalls- Click Install, disable (clear) Group HA Peers, select either of the HA peers, select Reboot device after install, and click OK. Wait for the firewall to finish rebooting before you proceed.
- Click Install, disable (clear) Group HA Peers, select the HA peer that you didn’t update in the previous step, select Reboot device after install, and click OK.
Active/Passive HA FirewallsIn this example, the active firewall is named fw1 and the passive firewall is named fw2:- Install (Action column) the appropriate update, disable (clear) Group HA Peers, select fw2, select Reboot device after install, and click OK.
- After fw2 finishes rebooting, verify fw1 (DashboardHigh Availability widget) is still the active peer and that fw2 is still the passive peer (the Local firewall state is active and the Peer—fw2—is passive).
- Access fw1 and Suspend local device (DeviceHigh AvailabilityOperational Commands).
- Access fw2 (DashboardHigh Availability) and verify that the Local firewall state is active and the Peer firewall—fw1—is suspended.
- Access Panorama, select PanoramaDevice DeploymentSoftware, Install (Action column) the appropriate update, disable (clear) Group HA Peers, select fw1, select Reboot device after install, and click OK. Wait for fw1 to finish rebooting before you proceed.
- Access fw1 (DashboardHigh Availability widget) and
verify that the Local firewall state is passive and
the Peer—fw2—is active.If you enabled preemption in the Election settings (DeviceHigh AvailabilityGeneral), then fw1 will be reinstated as the active peer after reboot.
- Check Now for
available images (PanoramaDevice DeploymentSoftware).
- Downgrade each Log Collector running
Panorama 10.2.Downgrading from PAN-OS 10.2 to a previous feature release requires that you first downgrade to PAN-OS 10.1.3 or later PAN-OS 10.1 release. After successfully downgrading to PAN-OS 10.1.3 or later PAN-OS 10.1 release, you can continue downgrading to your target PAN-OS version.
- Check Now for available images
(PanoramaDevice DeploymentSoftware).(PAN-OS 10.2.10 and later 10.2 releases) By default, the preferred releases and the corresponding base releases are displayed. To view the preferred releases only, disable (clear) the Base Releases checkbox. Similarly, to view the base releases only, disable (clear) the Preferred Releases checkbox.
- Locate the Panorama 10.2 image. If the image is not already downloaded, then Download it (Action column).
- After the download is complete, Install the image on each Log Collector running Panorama 10.1. Select Reboot device after install to automatically reboot the device when the upgrade is complete.
- Check Now for available images
(PanoramaDevice DeploymentSoftware).
- Downgrade Panorama.Downgrading from PAN-OS 10.2 to a previous feature release requires that you first downgrade to PAN-OS 10.1.3 or later PAN-OS 10.1 release. After successfully downgrading to PAN-OS 10.1.3 or later PAN-OS 10.1 release, you can continue downgrading to your target PAN-OS version.
- Select PanoramaSoftware and Check
Now for available images.(PAN-OS 10.2.10 and later 10.2 releases) By default, the preferred releases and the corresponding base releases are displayed. To view the preferred releases only, disable (clear) the Base Releases checkbox. Similarly, to view the base releases only, disable (clear) the Preferred Releases checkbox.
- Locate the Panorama 10.2 image. If the image is not already downloaded, then Download it.
- After the download is complete, Install the image on Panorama.
- Reboot Panorama as follows:
- If you are prompted to reboot, click Yes. If you see a CMS Login prompt, press Enter without typing the username or password. When the Panorama login prompt appears, enter the username and password you set during initial configuration.
- If you are not prompted to reboot, select PanoramaSetupOperations and click Reboot Panorama (Device Operations).
- Select PanoramaSoftware and Check
Now for available images.
- (ZTP plugin only) Re-install the ZTP plugin.
- Log in to the Panorama web interface.
- Install the ZTP plugin.
- Select PanoramaZero Touch Provisioning and check (enable) ZTP.
- (Enterprise DLP only) Edit the Enterprise DLP data filtering
settings to reduce the Max File Size to 20MB
or less.This is required when downgrading from Panorama plugin for Enterprise DLP 3.0.3 or later release. Large file size inspection is supported on Enterprise DLP 3.0.3 and later releases only.
- (Panorama Interconnect plugin only) Synchronize the Panorama Node with the
Panorama Controller.After you successfully downgrade a Panorama Node, you must synchronize the Panorama Controller and Panorama Node configuration. This is required to successfully push the common Panorama Controller configuration to your Panorama Node.