You can use Panorama™ to qualify software and content updates by deploying them to a subset of firewalls, Dedicated Log Collectors, or WildFire® appliances and appliance clusters before installing the updates on the rest of your managed appliances. If you want to schedule periodic content updates, Panorama requires a direct internet connection. To deploy software or content updates on demand (unscheduled), the procedure differs based on whether Panorama is connected to the internet. Panorama displays a warning if you manually deploy a content update when a scheduled update process has started or will start within five minutes.

When deploying updates, Panorama notifies the managed appliances (firewalls, Log Collectors, and WildFire appliances) that updates are available and the appliances then retrieve the update packages from Panorama. By default, managed appliances retrieve updates over the management (MGT) interface on Panorama. However, if you want to reduce the traffic load on the MGT interface by using another interface for appliances to retrieve updates, you can Configure Panorama to Use Multiple Interfaces.

You can quickly revert a content version for one or more firewalls to the previously installed content version using Panorama. After a new content version is installed on the firewall, you can revert back to the previously installed version if the newly installed content version destabilizes or otherwise disrupts your network operations.