Upgrade Panorama with an Internet Connection

If Panorama™ has a direct connection to the internet, perform the following steps to install Panorama software and content updates as needed. If Panorama is running in a high availability (HA) configuration, upgrade the Panorama software on each peer (see Upgrade Panorama in an HA Configuration). If you are upgrading Panorama and managed devices in FIPS-CC mode to PAN-OS 10.2, you must take the additional steps of resetting the secure connection status of the devices in FIPS-CC mode if added to Panorama management while running a PAN-OS 10.2 release. See Upgrade Panorama and Manged Devices in FIPS-CC Mode for more details on upgrading Panorama and FIPS-CC devices in FIPS-CC mode.
Upgrading the software on the Panorama virtual appliance does not change the system mode; switching to Panorama mode or Management Only mode is a manual task that requires additional settings as described when you Set Up the Panorama Virtual Appliance with a Local Log Collector.
If you are upgrading from PAN-OS 8.1, PAN-OS® 9.0 introduced a new log data format for local and Dedicated Log Collectors. On your upgrade path to PAN-OS 10.2, existing log data is automatically migrated to the new format when you upgrade from PAN-OS 8.1 to PAN-OS 9.0.
You must upgrade all Log Collectors in a collector group at the same time to avoid losing log data loss. No log forwarding or log collection occurs if the Log Collectors in a collector group are not all running the same PAN-OS version. Additionally, the log data for the Log Collectors in the collector group is not visible in the
ACC
or
Monitor
tabs until all Log Collectors are running the same PAN-OS version. For example, if you have three Log Collectors in a collector group and you upgrade two of the Log Collectors, then no logs are forwarded to any Log Collectors in the collector group.
Before you upgrade Panorama, refer to the Release Notes for the minimum content release version required for PAN-OS® 10.2.
  1. Verify that the updates you plan to install are appropriate for your Panorama deployment.
    Palo Alto Networks highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version.
  2. You cannot skip the installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 10.2.
    Review PAN-OS Upgrade Checklist, the known issues and changes to default behavior in the Release Notes and Upgrade/Downgrade Considerations for each release through which you pass as part of your upgrade path.
  3. Save a backup of the current Panorama configuration file that you can use to restore the configuration if you have problems with the upgrade.
    Although Panorama automatically creates a backup of the configuration, best practice is to create and externally store a backup before you upgrade.
    1. Save named Panorama configuration snapshot
      (
      Panorama
      Setup
      Operations
      ), enter a
      Name
      for the configuration, and click
      OK
      .
    2. Export named Panorama configuration snapshot
      , select the
      Name
      of the configuration you just saved, click
      OK
      , and save the exported file to a location that is external to Panorama.
  4. (
    Best Practices
    ) If you are leveraging Cortex Data Lake (CDL), install the Panorama device certificate.
    Panorama automatically switches to using the device certificate for authentication with CDL ingestion and query endpoints on upgrade to PAN-OS 10.2.
    If you do not install the device certificate prior to upgrade to PAN-OS 10.2, Panorama continues to use the existing logging service certificate for authentication.
  5. Install the latest content updates.
    If Panorama is not running the minimum content versions required for the Panorama release to which you intend to upgrade, you must update content versions to the minimum (or later) versions before you install the software updates. Refer to Release Notes for minimum content release version for a Panorama release.
    Palo Alto Networks® highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version. Additionally, we recommend that you schedule automatic, recurring updates so that you are always running the latest content versions (refer to 13).
    1. Select
      Panorama
      Dynamic Updates
      and
      Check Now
      for the latest updates. If the value in the Action column is
      Download
      , an update is available.
      Ensure that Panorama is running the same but not a later content release version than is running on managed firewalls and Log Collectors.
    2. (Before you update the content release version on Panorama, be sure to upgrade managed firewalls and then Log Collectors (see Upgrade Log Collectors When Panorama Is Internet-Connected) to the same (or a later) content release version.
      If you do not need to install content updates at this time, then skip ahead to the next step.
    3. Install remaining content updates, as needed. When installed, the Currently Installed column displays a check mark.
      1. Download
        and
        Install
        the Applications or Applications and Threats update. Regardless of your subscription, Panorama installs and needs only the Applications content update, not the Threats content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
      2. Download
        and
        Install
        other updates (Antivirus, WildFire®, or URL Filtering) as needed, one at a time, and in any sequence.
  6. Select
    Panorama
    Plugins
    and
    Download
    the plugin version supported on PAN-OS 10.2 for all plugins currently installed on Panorama.
    See the Compatible Plugin Versions for PAN-OS 10.2 for the Panorama plugin version supported on PAN-OS 10.2.
    This is required to successfully upgrade Panorama from PAN-OS 10.1 to PAN-OS 10.2. Upgrade to PAN-OS 10.2 is blocked if the supported plugin version is not downloaded.
    The downloaded plugins required to upgrade to PAN-OS 10.2 should automatically install after Panorama successfully upgrades to PAN-OS 10.2. If a downloaded plugin does not automatically install, you must manually install the impacted plugin after upgrade to PAN-OS 10.2.
    If you have the Zero Touch Provisioning (ZTP) plugin installed, you can download ZTP plugin 2.0.1 and upgrade to PAN-OS 10.2.1 to automatically install the ZTP plugin after successful upgrade. Otherwise, you must manually download and install the ZTP plugin 2.0.0 after successful upgrade to PAN-OS 10.2.0
  7. Upgrade Panorama to the PAN-OS releases along your upgrade path to PAN-OS 10.2.
    1. PAN-OS 9.0 introduced a new log format. If a local Log Collector is configured, logs are automatically migrated to the new format after you successfully upgrade Panorama to PAN-OS 9.0.
      Do not continue on your upgrade path until you verify the automatic log migration completed successfully.
    2. (
      Panorama in Legacy mode only
      )
      Download
      PAN-OS 10.0.0 and then
      Download
      and
      Install
      PAN-OS 10.0.8 or later release before you continue on your upgrade path.
      This is required to preserve all logs stored on the NFS storage partition. Some logs stored on the NFS storage partition of a Panorama in Legacy mode are deleted if you install PAN-OS 10.0.7 or earlier PAN-OS 10.0 release.
    3. PAN-OS 10.2 introduces a new log format. On upgrade from PAN-OS 10.2 to PAN-OS 10.1, you can choose to migrate logs generated in PAN-OS 8.1 or earlier release. Otherwise, these logs are automatically deleted on successful upgrade to PAN-OS 10.1. During migration, log data is not visible in the ACC or Monitor tabs. While the migration takes place, log data continues forwarding to the appropriate Log Collector but you may experience some impact to performance.
      (
      Panorama in Legacy mode only
      )
      Download
      PAN-OS 10.1.0 and then
      Download
      and
      Install
      PAN-OS 10.1.3 or later release.
      This is required to preserve all logs stored on the NFS storage partition. Some logs stored on the NFS storage partition of a Panorama in Legacy mode are deleted if you install PAN-OS 10.1.2 or earlier PAN-OS 10.2 release.
  8. Upgrade Panorama to PAN-OS 10.2.
    If you have the Zero Touch Provisioning (ZTP) plugin installed, you can download PAN-OS 10.2.0 and then upgrade to PAN-OS 10.2.1 to automatically install ZTP plugin 2.0.1 on successful upgrade to PAN-OS 10.2.1 or later PAN-OS 10.2 release.
    1. Check Now
      (
      Panorama
      Software
      ) for the latest releases. If a software release is available, the Action column displays
      Download
      .
    2. Locate and
      Download
      the PAN-OS 10.2.0 image. After a successful download, the Action column changes from
      Download
      to
      Install
      for the downloaded image.
    3. Install the downloaded image and then reboot.
      1. Install the image.
      2. After the installation completes successfully, reboot using one of the following methods:
        • If prompted to reboot, click
          Yes
          . If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the username and password you specified during initial configuration.
        • If you are not prompted to reboot,
          Reboot Panorama
          from the Device Operations section (
          Panorama
          Setup
          Operations
          ).
  9. After Panorama reboots, verify that your Panorama plugin versions are supported on PAN-OS 10.2.
    You must verify that the plugin versions you downloaded before the upgrade to PAN-OS 10.2 successfully installed. For any plugin that did not automatically install, you must manually install the plugin on Panorama. See the Compatible Plugin Versions for PAN-OS 10.2 for the Panorama plugin version supported on PAN-OS 10.2.
    1. Log in to the Panorama web interface and review the General Information widget in the
      Dashboard
      to verify the PAN-OS 10.2 compatible plugin versions successfully installed.
      You can also log in to the Panorama CLI and enter the command
      show plugins installed
      to view the list of currently installed plugins.
      The ZTP plugin 2.0.0 is not displayed when you run this command. You must download and install the ZTP plugin 2.0.0 after upgrade to PAN-OS 10.2.0.
    2. Select
      Panorama
      Plugins
      and search for the plugin that did not install.
    3. Install
      the plugin version supported on PAN-OS 10.2.
      (
      ZTP plugin only
      )
      Download
      and
      Install
      the ZTP plugin 2.0.0 if you upgraded to PAN-OS 10.2.0.
    4. Repeat the steps above until all plugins installed on Panorama are running the version supported on PAN-OS 10.2.
  10. (
    If local Log Collector is in a Collector Group
    ) Upgrade the remaining Log Collectors in the Collector Group.
  11. (
    Panorama and managed devices in FIPS-CC mode
    ) Re-onboard your managed devices to Panorama management.
    Upgrading Panorama and managed devices in FIPS-CC mode requires you to reset the secure connection status of the devices in FIPS-CC mode if added to Panorama management while running a PAN-OS 10.2 release. You need to re-onboard the following managed devices to Panorama management:
    • Managed devices in FIPS-CC mode added to Panorama using the device registration authentication key.
    • Managed devices in the normal operational mode added to Panorama using the device registration authentication key
    You do not need to re-onboard managed devices added to Panorama management while the managed device was running a PAN-OS 10.0 or earlier release.
  12. Regenerate or re-import all certificates to adhere to OpenSSL Security Level 2.
    On upgrade to PAN-OS 10.2, it is required that all certificates meet the following minimum requirements:
    • RSA 2048 bits or greater, or ECDSA 256 bits or greater
    • Digest of SHA256 or greater
    See the PAN-OS Administrator's Guide or Panorama Administrator's Guide for more information on regenerating or re-importing your certificates.
  13. (
    Best Practice
    ) Schedule recurring, automatic content updates.
    Panorama does not synchronize content update schedules across HA peers. You must perform this task on both the active and passive Panorama.
    In the header row for each update type (
    Panorama
    Dynamic Updates
    ), the
    Schedule
    is initially set to
    None
    . Perform the following steps for each update type.
    1. Click
      None
      and select the update frequency (
      Recurrence
      ). The frequency options depend on the update type.
    2. Select the schedule action:
      • Download And Install
        (
        Best Practice
        )—Panorama automatically installs updates after downloading them.
        Download Only
        —You must manually install updates after Panorama downloads them.
    3. Based on the best practices for the security posture of your organization, configure a delay (
      Threshold
      ) after an update becomes available before Panorama downloads the update.
    4. Click
      OK
      to save your changes.
    5. Select
      Commit
      Commit to Panorama
      and
      Commit
      your changes.

Recommended For You