Upgrade Panorama Without an Internet Connection

Verify that the updates you plan to install are appropriate for your Panorama deployment.
Palo Alto Networks highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version.
Refer to the Release Notes for the minimum content release version you must install for a Panorama software release. If you intend to upgrade Log Collectors and firewalls to a particular release, you must first upgrade Panorama to that (or a later) release.
For a Panorama virtual appliance, ensure that the instance meets the Setup Prerequisites for the Panorama Virtual Appliance.
Determine the Upgrade Path to PAN-OS 10.2.
You cannot skip the installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 10.2.
Review PAN-OS Upgrade Checklist, the known issues and changes to default behavior in the Release Notes and Upgrade/Downgrade Considerations for each release through which you pass as part of your upgrade path.
(
Panorama Interconnect plugin only
) Synchronize the Panorama Node with the Panorama Controller.
Before you begin upgrading a Panorama Node, you must synchronize the Panorama Controller and Panorama Node configuration. This is required to successfully push the common Panorama Controller configuration to your Panorama Node after successful upgrade.
Save a backup of the current Panorama configuration file that you can use to restore the configuration if you have problems with the upgrade.
Although Panorama automatically creates a backup of the configuration, best practice is to create and externally store a backup before you upgrade.
Log in to the Panorama web interface.
Save named Panorama configuration snapshot
(
Panorama
Setup
Operations
), enter a
Name
for the configuration, and click
OK
.
Export named Panorama configuration snapshot
, select the
Name
of the configuration you just saved, click
OK
, and save the exported file to a location that is external to Panorama.
Download the latest content updates to a host that can connect and upload content to Panorama either over SCP or HTTPS.
If you do not need to install content updates at this time, then skip ahead to 6.
Use a host that has internet access to log in to the Palo Alto Networks Customer Support website.
Download content updates as needed:
Click
Updates
Dynamic Updates
in the Resources section.
Download
the appropriate content updates and save the files to the host. Perform this step for each content type you need to update.
Install the latest content updates.
You must install content updates before software updates and you must upgrade firewalls first and then upgrade Log Collectors before you install them on the Panorama management server.
Install the Applications or Applications and Threats update first, and then install any other updates (Antivirus, WildFire®, and URL Filtering), one at a time, and in any sequence.
Regardless whether your subscription includes both Applications and Threats content, Panorama installs and needs only the Applications content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
Log in to the Panorama web interface and perform the following steps for each content type:
Select
Panorama
Dynamic Updates
.
Click
Upload
, select the content
Type
,
Browse
to the location on the host to which you downloaded the update, select the update, and click
OK
.
Install From File
, select the
Package Type
, and click
OK
.
Upload the plugin version supported on PAN-OS 10.2 for all plugins currently installed on Panorama.
See the Compatibility Matrix for the Panorama plugin version supported for your target PAN-OS 10.2 release.
This is required to successfully upgrade Panorama from PAN-OS 10.1 to PAN-OS 10.2. Upgrade to PAN-OS 10.2 is blocked if the supported plugin version is not downloaded.
The downloaded plugins required to upgrade to PAN-OS 10.2 should automatically install after Panorama successfully upgrades to PAN-OS 10.2. If a downloaded plugin does not automatically install, you must manually install the impacted plugin after upgrade to PAN-OS 10.2
Download the plugin version supported on PAN-OS 10.2.
Log in to the Palo Alto Networks Support Portal.
Select
Updates
Software Updates
and select the plugin from the drop-down menu.
Download
the plugin version supported on PAN-OS 10.2.
Repeat this step for all plugins currently installed on Panorama.
Log in to the Panorama web interface
Select
Panorama
Plugins
and
Upload
the plugin version you downloaded in the previous step.
Repeat this step for all plugins currently installed on Panorama.
Upgrade Panorama to the PAN-OS releases along your upgrade path to PAN-OS 10.2.
Upgrade Panorama When Not Internet Connected to PAN-OS 8.1.
Upgrade Panorama When Not Internet Connected to PAN-OS 9.0.
PAN-OS 9.0 introduced a new log format. If a local Log Collector is configured, logs are automatically migrated to the new format after you successfully upgrade Panorama to PAN-OS 9.0.
Do not continue on your upgrade path until you verify the automatic log migration completed successfully.
Upgrade Panorama When Not Internet Connected to PAN-OS 9.1.
Upgrade Panorama When Not Internet Connected to PAN-OS 10.0.
(
Panorama in Legacy mode only
)
Download
PAN-OS 10.0.0 and then
Download
and
Install
PAN-OS 10.0.8 or later release before you continue on your upgrade path.
This is required to preserve all logs stored on the NFS storage partition. Some logs stored on the NFS storage partition of a Panorama in Legacy mode are deleted if you install PAN-OS 10.0.7 or earlier PAN-OS 10.0 release.
Upgrade Panorama When Not Internet Connected to PAN-OS 10.1.
PAN-OS 10.1 introduces a new log format. On upgrade from PAN-OS 10.0 to PAN-OS 10.1, you can choose to migrate logs generated in PAN-OS 8.1 or earlier release. Otherwise, these logs are automatically deleted on successful upgrade to PAN-OS 10.1. During migration, log data is not visible in the ACC or Monitor tabs. While the migration takes place, log data continues forwarding to the appropriate Log Collector but you may experience some impact to performance.
(
Panorama in Legacy mode only
)
Download
PAN-OS 10.1.0 and then
Download
and
Install
PAN-OS 10.1.3 or later release.
This is required to preserve all logs stored on the NFS storage partition. Some logs stored on the NFS storage partition of a Panorama in Legacy mode are deleted if you install PAN-OS 10.1.2 or earlier PAN-OS 10.1 release.
Download the latest PAN-OS 10.2 release image to a host that can connect and upload content to Panorama either over SCP or HTTPS.
Use a host with internet access to log in to the Palo Alto Networks Customer Support web site.
Download software updates:
On the main page of Palo Alto Networks Customer Support website, click
Updates
Software Updates
.
Locate the model-specific for the latest PAN-OS 10.2 release image. For example, to upgrade an M-Series appliance to Panorama 10.2.0, download the
Panorama_m-10.2.0
image; to upgrade a Panorama virtual appliance to Panorama 10.2.0, download the
Panorama_pc-10.2.0
image.
You can quickly locate Panorama images by selecting
Panorama M Images
(M-Series appliances) or
Panorama Updates
(virtual appliances) from the
Filter By
drop-down.
Click the filename and save the file to the host.
Upgrade Panorama to PAN-OS 10.2.
Log in to the Panorama web interface.
Select
Panorama
Software
and
Upload
the PAN-OS 10.2 image you downloaded in the previous step.
Browse
to the location on the host to which you downloaded the update, select the update,
Sync To Peer
if Panorama is in an HA configuration (to push the software image to the secondary peer), and click
OK
.
Install the software image and reboot.
For an HA configuration, Upgrade Panorama in an HA Configuration; otherwise:
Install
the uploaded image.
After you successfully complete the installation, reboot using one of the following methods:
If prompted to reboot, click
Yes
. If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the username and password you specified during initial configuration.
If you are not prompted to reboot,
Reboot Panorama
from the Device Operations section (
Panorama
Setup
Operations
).
After Panorama reboots, verify that your Panorama plugin versions are supported on PAN-OS 10.2.
You must verify that the plugin versions you downloaded before the upgrade to PAN-OS 10.2 successfully installed. For any plugin that did not automatically install, you must manually install the plugin on Panorama. See the Compatibility Matrix for the Panorama plugin version supported on your target PAN-OS 10.2 version.
Log in to the Panorama web interface and review the General Information widget in the
Dashboard
to verify the PAN-OS 10.2 compatible plugin versions successfully installed.
You can also log in to the Panorama CLI and enter the command
show plugins installed
to view the list of currently installed plugins.
Select
Panorama
Plugins
and search for the plugin that did not install.
Install
the plugin version supported on PAN-OS 10.2.
Repeat the steps above until all plugins installed on Panorama are running the version supported on PAN-OS 10.2.
(
If local Log Collector is in a Collector Group
) Upgrade the remaining Log Collectors in the Collector Group.
Upgrade Log Collectors When Panorama Is Internet-Connected
Upgrade Log Collectors When Panorama Is Not Internet-Connected
Select
Commit
Commit and Push
and
Commit and Push
the Panorama managed configuration to all managed devices.
After you successfully upgrade Panorama and managed devices to PAN-OS 10.2, a full commit and push of the Panorama managed configuration is required before you can push selective configuration to your managed devices and leverage the improved shared configuration object management for multi-vsys firewalls managed by Panorama.