Upgrade Log Collectors When Panorama Is Internet-Connected
Table of Contents
11.0
Expand all | Collapse all
-
-
- Upgrade Panorama with an Internet Connection
- Upgrade Panorama Without an Internet Connection
- Install Content Updates Automatically for Panorama without an Internet Connection
- Upgrade Panorama in an HA Configuration
- Migrate Panorama Logs to the New Log Format
- Upgrade Panorama for Increased Device Management Capacity
- Upgrade Panorama and Managed Devices in FIPS-CC Mode
- Downgrade from Panorama 11.0
- Troubleshoot Your Panorama Upgrade
-
- What Updates Can Panorama Push to Other Devices?
- Schedule a Content Update Using Panorama
- Panorama, Log Collector, Firewall, and WildFire Version Compatibility
- Upgrade Log Collectors When Panorama Is Internet-Connected
- Upgrade Log Collectors When Panorama Is Not Internet-Connected
- Upgrade a WildFire Cluster from Panorama with an Internet Connection
- Upgrade a WildFire Cluster from Panorama without an Internet Connection
- Upgrade Firewalls When Panorama Is Internet-Connected
- Upgrade Firewalls When Panorama Is Not Internet-Connected
- Upgrade a ZTP Firewall
- Revert Content Updates from Panorama
-
Upgrade Log Collectors When Panorama Is Internet-Connected
Upgrade Log Collector software to PAN-OS® 11.0 and install
content updates using Panorama™ when Panorama is connected to the
internet.
For a list of software or content updates
you can install on Log Collectors, see Supported
Updates.
If you are upgrading from PAN-OS 8.1,
PAN-OS 9.0 introduced a new log data format for local and Dedicated
Log Collectors. On your upgrade path to PAN-OS 10.1, existing log
data is automatically migrated to the new log data format when you
upgrade from PAN-OS 8.1 to PAN-OS 9.0.
You must upgrade
all Log Collectors in a collector group at the same time to avoid
losing log data. No log forwarding or log collection occurs if the
Log Collectors in a collector group are not all running the same
PAN-OS version. Additionally, the log data for the Log Collectors
in the collector group is not visible in the ACC or Monitor tabs
until all Log Collectors are running the same PAN-OS version. For
example, if you have three Log Collectors in a collector group and
you upgrade two of the Log Collectors, then no logs are forwarded
to any Log Collectors in the collector group.
Palo Alto Networks
recommends that you upgrade Log Collectors during a maintenance
window. Due to log format migration, the entire upgrade procedure takes
an additional number of hours depending on the amount of log data
on the local and Dedicated Log Collectors.
- Before you upgrade Log Collectors, ensure that
you are running the appropriate Panorama™ software release on the
Panorama management server.Palo Alto Networks® highly recommends that Panorama and Log Collectors run the same software release version and that Panorama, Log Collectors, and all managed firewalls run the same content release version. For important software and content compatibility details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.Panorama must be running the same (or later) software release as Log Collectors but must have the same or later content release version:
- Software release version—If your Panorama management server is not already running the same or a later software release than the release to which you intend to update Log Collectors, then you must install the same or a later Panorama release on Panorama (see Install Content Updates and Software Upgrades for Panorama) before you update any Log Collectors.
- Content release version—For content release versions, you should ensure that all Log Collectors are running the latest content release version or, at minimum, running a later version than is running on Panorama; if not, then first Upgrade the Firewall to PAN-OS 11.0 from Panorama and then update Log Collectors before you update the content release version on the Panorama management server.
To check software and content versions:- Panorama management server—To determine which software and content versions are running on the Panorama management server, log in to the Panorama web interface and go to General Information settings (Dashboard).
- Log Collectors—To determine which software and content versions are running on Log Collectors, log in to the CLI of each Log Collector and run the show system info command.
- Determine the Upgrade Path to PAN-OS 11.0.You cannot skip installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 11.0.0.Review PAN-OS Upgrade Checklist, the known issues and changes to default behavior in the Release Notes and Upgrade/Downgrade Considerations for each release through which you pass as part of your upgrade path.
- Install the latest content updates.Refer to the Release Notes for the minimum content release versions required for a Panorama software release.
- Log in to the Panorama web interface.
- Select PanoramaDevice DeploymentDynamic Updates and Check Now for the latest updates. If an update is available, the Action column displays a Download link.
- If not already installed, Download the appropriate content updates. After a successful download, the link in the Action column changes from Download to Install.
- Install the
content update (Applications and Threats update) before any others. If your subscription includes both Applications and Threats content, install the Apps content first. This automatically installs both Application and Threats content.Regardless whether your subscription includes both Applications and Threats content, Panorama installs and needs only the Applications content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
- Repeat the substeps above for any other updates (Antivirus, WildFire, or URL Filtering) as needed, one at a time, and in any sequence.
- Upgrade the Log Collector to the PAN-OS releases along
your upgrade path to PAN-OS 11.0.If upgrading more than one Log Collector, streamline the process by determining the upgrade paths for all Log Collectors you intend to upgrade before you start downloading images.
- Upgrade Log Collectors When Panorama is Internet-Connected to PAN-OS 8.1.
- Upgrade Log Collectors When Panorama
is Internet-Connected to PAN-OS 9.0.PAN-OS 9.0 introduced a new log format. Logs are automatically migrated to the new format after you successfully upgrade the Log Collector to PAN-OS 9.0.Do not continue on your upgrade path until you verify the automatic log migration completed successfully.
- Upgrade Log Collectors When Panorama is Internet-Connected to PAN-OS 9.1.
- Upgrade Log Collectors When Panorama is Internet-Connected to PAN-OS 10.0.
- Upgrade Log Collectors When Panorama
is Internet-Connected to PAN-OS 10.1.PAN-OS 11.0 introduces a new log format. On upgrade from PAN-OS 11.0 to PAN-OS 10.1, you can choose to migrate logs generated in PAN-OS 8.1 or earlier release. Otherwise, these logs are automatically deleted on successful upgrade to PAN-OS 10.1. During migration, log data is not visible in the ACC or Monitor tabs. While the migration takes place, log data continues forwarding to the appropriate Log Collector but you may experience some impact to performance.
- Upgrade Log Collectors When Panorama is Internet-Connected to PAN-OS 10.2.
- Upgrade the Log Collector to PAN-OS 11.0.
- On Panorama, Check Now (PanoramaDevice DeploymentSoftware) for the latest updates. If an update is available, the Action column displays a Download link.
- Download the model-specific
file for the release version of the PAN-OS 11.0 release. For example,
to upgrade an M-Series appliance to Panorama 11.0.0, download the Panorama_m-11.0.0 image.After a successful download, the Action column changes from Download to Install for that image.
- Install PAN-OS 11.0 and select the appropriate Log Collectors.
- Select one of the following depending on your needs:
- Upload only to device (do not install).
- Reboot device after install.
- Click OK to start the upload or installation.
- Verify the software and content update versions that
are installed on the Log Collector.Enter the show system info operational command. The output will resemble the following:
sw-version: 11.0.0 app-version: 8270-6076 app-release-date: 2020/05/08 18:21:51
- (FIPS-CC mode only) Upgrade Panorama and Managed Devices in FIPS-CC Mode.Upgrading a Dedicated Log Collector in FIPS-CC mode requires you to reset the secure connection status if you added the Dedicated Log Collector to Panorama management while the Dedicated Log Collector was running a PAN-OS 11.0 release.You do not need to re-onboard the Dedicated Log Collector added to Panorama management while the Dedicated Log Collector was running a PAN-OS 10.0 or earlier release.
- (PAN-OS 10.2 and later releases) Regenerate
or re-import all certificates to adhere to OpenSSL Security Level
2.This step is required if you upgrade from PAN-OS 10.1 or earlier release to PAN-OS 11.0. Skip this step if you upgrade from PAN-OS 10.2 and have already regenerated or re-imported your certificates.It is required that all certificates meet the following minimum requirements:
- RSA 2048 bits or greater, or ECDSA 256 bits or greater
- Digest of SHA256 or greater
See the PAN-OS Administrator's Guide or Panorama Administrator's Guide for more information on regenerating or re-importing your certificates. - (Recommended for Panorama virtual appliance) Increase the memory of the Panorama
virtual appliance to 64GB.After you successfully upgrade the Panorama virtual appliance in Log Collector mode to PAN-OS 11.0, Palo Alto Networks recommends increasing the memory of the Panorama virtual appliance to 64GB to meet the increased system requirements to avoid any logging, management, and operational performance issues related to an under-provisioned Panorama virtual appliance.