Upgrade the VM-Series Model
Table of Contents
Expand all | Collapse all
- Upgrade Panorama with an Internet Connection
- Upgrade Panorama Without an Internet Connection
- Install Content Updates Automatically for Panorama without an Internet Connection
- Upgrade Panorama in an HA Configuration
- Migrate Panorama Logs to the New Log Format
- Upgrade Panorama for Increased Device Management Capacity
- Upgrade Panorama and Managed Devices in FIPS-CC Mode
- Downgrade from Panorama 11.0
- Troubleshoot Your Panorama Upgrade
- What Updates Can Panorama Push to Other Devices?
- Schedule a Content Update Using Panorama
- Panorama, Log Collector, Firewall, and WildFire Version Compatibility
- Upgrade Log Collectors When Panorama Is Internet-Connected
- Upgrade Log Collectors When Panorama Is Not Internet-Connected
- Upgrade a WildFire Cluster from Panorama with an Internet Connection
- Upgrade a WildFire Cluster from Panorama without an Internet Connection
- Upgrade Firewalls When Panorama Is Internet-Connected
- Upgrade Firewalls When Panorama Is Not Internet-Connected
- Upgrade a ZTP Firewall
- Revert Content Updates from Panorama
- PAN-OS Upgrade Checklist
- Upgrade/Downgrade Considerations
- Troubleshoot Your PAN-OS Upgrade
- Upgrade the VM-Series PAN-OS Software (Standalone)
- Upgrade the VM-Series PAN-OS Software (HA Pair)
- Upgrade the VM-Series PAN-OS Software Using Panorama
- Upgrade the VM-Series Model
- Upgrade the VM-Series Model in an HA Pair
- Downgrade a VM-Series Firewall to a Previous Release
Upgrade the VM-Series Model
How do I upgrade my VM-Series model?
The licensing process for the VM-Series firewall uses the UUID and the CPU ID to generate a unique serial number for each VM-Series firewall. Hence, when you generate a license, the license is mapped to a specific instance of the VM-Series firewall and cannot be modified.
Use the instructions in this section if you are:
- Migrating from an evaluation license to a production license.
- Upgrading the model to allow for increased capacity. For example you want to upgrade from the VM-100 to the VM-300 model.
- Upgrading capacity, which restarts some critical processes on the firewall. An HA configuration is recommended to minimize service disruption; to upgrade the capacity on a HA pair, see Upgrade the VM-Series Model in an HA Pair.
- In a private or public cloud deployment, if your firewall is licensed with the BYOL option, you must deactivate your VM before you change the instance type or VM type. Upgrading the model or instance changes the UUID and CPU ID, so you must apply the license when the .
- Allocate additional hardware resources to your VM-Series firewall.Before initiating the capacity upgrade, you must verify that enough hardware resources are available to the VM-Series firewall to support the new capacity. The process for assigning additional hardware resources differs on each hypervisor.To check the hardware requirements for your new VM-Series model, see VM-Series Models.Although the capacity upgrade does not require a reboot of the VM-Series firewall, you need to power down the virtual machine to change the hardware allocation.
- Retrieve the license API key from the Customer Support portal.
- Log in to the Customer Support Portal.Make sure that you are using the same account that you used to register the initial license.
- From the menu on the left, select.AssetsAPI Key Management
- Copy the API key.
- On the firewall, use the CLI to install the API key copied in the previous step.request license api-key set key <key>
- (If you have internet access) Enable the firewall toVerify Update Server identityon.DeviceSetupService
- Commityour changes. Ensure that you have a locally-configured user on the firewall. Panorama pushed users might not be available after the deactivation if the configuration exceeds the non-licensed PA-VM objects limit.
- Upgrade the capacity.Selectand then activate your licenses and subscriptions in one of the following ways:DeviceLicensesUpgrade VM Capacity
- (internet)Retrieve license keys from license server—Use this option if you activated your license on the Customer Support portal.
- (internet)Use an authorization code—Use this option to upgrade the VM-Series capacity using an authorization code for licenses that have not been previously activated on the support portal. When prompted, enter theAuthorization Codeand then clickOK.
- (no internet)Manually upload license key—Use this option if your firewall does not have internet connectivity to the Customer Support portal. From a computer with access to the internet, log in to the CSP, download a license key file, transfer it to a computer in the same network as the firewall, and upload it to the firewall.
- Verify that your firewall is licensed successfully.On thepage, verify that the license was successfully activated.DeviceLicenses