Downgrade from Panorama 10.2

Procedure on how to downgrade from Panorama 10.2 to Panorama 10.1.
PAN-OS® 10.2 introduces advanced threat prevention to detect and prevent the latest advanced threats, advanced URL filtering to analyze suspicious web page content in real-time, an advanced routing engine that uses an industry-standard configuration methodology, simplified software upgrade for Panorama and managed devices to reduce the operational burden of upgrading managed devices across multiple PAN-OS releases, improved Log Collector health status monitoring, automatic content pushes for VM-Series and CN-Series firewalls managed by Panorama to reduce the operational overhead required to generate images with the latest content updates, and administrator-level push to selectively push configuration changes to managed firewalls. These features are not compatible with Panorama running PAN-OS 10.2 or earlier release. Use the following workflow to downgrade firewalls before you downgrade Log Collectors and Panorama running a Panorama 10.2 release to an earlier feature release. This procedure works both for Panorama when managing a local Log Collector and for Panorama when managing one or more Dedicated Log Collectors.
To downgrade from PAN-OS 10.2 to an earlier PAN-OS release, you must download and install PAN-OS 10.1.3 or later PAN-OS 10.2 release before you can continue on your downgrade path to your target PAN-OS release. Downgrade from PAN-OS 10.2 fails if you attempt to downgrade to PAN-OS 10.1.2 or earlier PAN-OS 10.2 release.
Review the Palo Alto Networks Compatibility Matrix to confirm that the firewalls and appliances you intend to downgrade are compatible with the PAN-OS release to which you intend to downgrade. For the firewalls and appliances that you can downgrade, you should also review the Upgrade/Downgrade Considerations to ensure that you account for all features and configuration settings that will be different or unavailable after you downgrade.
  1. Save a backup of the configuration files for Panorama and managed devices.
    1. Export Panorama and device configuration snapshot
      (
      Panorama
      Setup
      Operations
      ).
    2. Save the exported .tgz file to a location external to Panorama, Log Collectors, and firewalls. You can use this backup to restore the configuration if you experience problems that cause you to start over.
  2. If you have configured authentication for a Dedicated Log Collector and removed the
    admin
    administrator, configure and push a new
    admin
    user to your Dedicated Log Collectors.
    Dedicated Log Collectors must have the
    admin
    user configured in order to downgrade to PAN-OS 9.1 and earlier releases.
  3. Select
    Panorama
    Plugins
    and
    Download
    the plugin version supported on PAN-OS 10.2 for all plugins currently installed on Panorama.
    See the Panorama Plugins Compatibility Matrix for the Panorama plugin version supported on PAN-OS 10.2 and earlier releases.
    This is required to successfully downgrade Panorama from PAN-OS 10.2 to PAN-OS 10.2 and earlier releases. The downloaded plugin version is automatically installed during downgrade to PAN-OS 10.1. Downgrade to PAN-OS 10.2 is blocked if the supported plugin version is not downloaded.
    (
    ZTP plugin only
    ) To successfully downgrade Panorama to PAN-OS 10.1, you must uninstall the ZTP plugin before you begin the downgrade process. After successful downgrade to PAN-OS 10.2, you must reinstall the ZTP plugin on Panorama.
  4. Downgrade each firewall running a PAN-OS 10.2 release.
    Downgrading from PAN-OS 10.2 to a previous feature release requires that you first downgrade to PAN-OS 10.1.3 or later PAN-OS 10.2 release. After successfully downgrading to PAN-OS 10.1.3 or later PAN-OS 10.2 release, you can continue downgrading to your target PAN-OS version.
    If downgrading more than one firewall, streamline the process by having each firewall-specific PAN-OS 10.2 image downloaded to Panorama before you start downgrading. For example, to downgrade your PA-220 firewall to PAN-OS 10.1., download the
    PanOS_220-10.1.0
    or
    PanOS_3000-10.1.0
    images.
    Panorama requires that all firewalls are running the same or an earlier PAN-OS release. So before you downgrade Panorama, use and repeat the appropriate tasks below according to your environment to downgrade all managed firewalls as needed:
    1. Check Now
      for available images (
      Panorama
      Device Deployment
      Software
      ).
    2. Locate the PAN-OS 10.2 image for each model or series of firewalls you intend to downgrade. If the image is not already downloaded, then
      Download
      it.
    Non-HA Firewall
    Install
    (Action column) the appropriate PAN-OS 10.2 version, select all the firewalls you intend to downgrade, select
    Reboot device after install
    , and click
    OK
    .
    Active/Active HA Firewalls
    1. Click
      Install
      , disable (clear)
      Group HA Peers
      , select either of the HA peers, select
      Reboot device after install
      , and click
      OK
      . Wait for the firewall to finish rebooting before you proceed.
    2. Click
      Install
      , disable (clear)
      Group HA Peers
      , select the HA peer that you didn’t update in the previous step, select
      Reboot device after install
      , and click
      OK
      .
    Active/Passive HA Firewalls
    In this example, the active firewall is named fw1 and the passive firewall is named fw2:
    1. Install
      (Action column) the appropriate update, disable (clear)
      Group HA Peers
      , select fw2, select
      Reboot device after install
      , and click
      OK
      .
    2. After fw2 finishes rebooting, verify fw1 (
      Dashboard
      High Availability
      widget) is still the active peer and that fw2 is still the passive peer (the Local firewall state is
      active
      and the Peer—fw2—is
      passive
      ).
    3. Access fw1 and
      Suspend local device
      (
      Device
      High Availability
      Operational Commands
      ).
    4. Access fw2 (
      Dashboard
      High Availability
      ) and verify that the Local firewall state is
      active
      and the Peer firewall—fw1—is
      suspended
      .
    5. Access Panorama, select
      Panorama
      Device Deployment
      Software
      ,
      Install
      (Action column) the appropriate update, disable (clear)
      Group HA Peers
      , select fw1, select
      Reboot device after install
      , and click
      OK
      . Wait for fw1 to finish rebooting before you proceed.
    6. Access fw1 (
      Dashboard
      High Availability
      widget) and verify that the Local firewall state is
      passive
      and the Peer—fw2—is
      active
      .
      If you enabled preemption in the Election settings (
      Device
      High Availability
      General
      ), then fw1 will be reinstated as the active peer after reboot.
  5. Downgrade each Log Collector running Panorama 10.2.
    Downgrading from PAN-OS 10.2 to a previous feature release requires that you first downgrade to PAN-OS 10.1.3 or later PAN-OS 10.2 release. After successfully downgrading to PAN-OS 10.1.3 or later PAN-OS 10.2 release, you can continue downgrading to your target PAN-OS version.
    1. Check Now
      for available images (
      Panorama
      Device Deployment
      Software
      ).
    2. Locate the Panorama 10.2 image. If the image is not already downloaded, then
      Download
      it (Action column).
    3. After the download is complete,
      Install
      the image on each Log Collector running Panorama 10.1. Select
      Reboot device after install
      to automatically reboot the device when the upgrade is complete.
  6. Downgrade Panorama.
    Downgrading from PAN-OS 10.2 to a previous feature release requires that you first downgrade to PAN-OS 10.1.3 or later PAN-OS 10.2 release. After successfully downgrading to PAN-OS 10.1.3 or later PAN-OS 10.2 release, you can continue downgrading to your target PAN-OS version.
    1. Check Now
      for available images (
      Panorama
      Device Deployment
      Software
      ).
    2. Locate the Panorama 10.2 image. If the image is not already downloaded, then
      Download
      it.
    3. After the download is complete,
      Install
      the image on Panorama.
    4. Reboot Panorama as follows:
      • If you are prompted to reboot, click
        Yes
        . If you see a
        CMS Login
        prompt, press Enter without typing the username or password. When the Panorama login prompt appears, enter the username and password you set during initial configuration.
      • If you are not prompted to reboot, select
        Panorama
        Setup
        Operations
        and click
        Reboot Panorama
        (Device Operations).
  7. (
    ZTP plugin only
    ) Re-install the ZTP plugin.
    1. Select
      Panorama
      Zero Touch Provisioning
      and check (enable)
      ZTP
      .

Recommended For You