: Upgrade Firewalls When Panorama Is Internet-Connected
Focus
Focus

Upgrade Firewalls When Panorama Is Internet-Connected

Table of Contents

Upgrade Firewalls When Panorama Is Internet-Connected

Procedure to upgrade managed firewalls when Panorama is Internet connected.
Review the PAN-OS 11.1 Release Notes and then use the following procedure to upgrade firewalls that you manage with Panorama. This procedure applies to standalone firewalls and firewalls deployed in a high availability (HA) configuration.
When upgrading HA firewalls across multiple feature PAN-OS releases, you must upgrade each HA peer to the same feature PAN-OS release on your upgrade path before continuing. For example, you are upgrading HA peers from PAN-OS 10.2 to PAN-OS 11.1. You must upgrade both HA peers to PAN-OS 11.0 before you can continue upgrading to the target PAN-OS 11.1 release. When HA peers are two or more feature releases apart, the firewall with the older release installed enters a
suspended
state with the message
Peer version too old
.
If Panorama is unable to connect directly to the updates server, follow the Upgrade Firewalls When Panorama Is Not Internet-Connected procedure so that you can manually download images to Panorama and then distribute the images to firewalls.
The new Skip Software Version Upgrade feature enables you to skip up to three releases when deploying upgrades from Panorama appliances on PAN-OS 11.1 to firewalls on PAN-OS 10.1 or later versions.
Before you can upgrade firewalls from Panorama, you must:
  • Make sure Panorama is running the same or a later PAN-OS version than you are upgrading to. You must upgrade Panorama and its Log Collectors to 11.1 before upgrading the managed firewalls to this version. In addition, when upgrading Log Collectors to 11.1, you must upgrade all Log Collectors at the same time due to changes in the logging infrastructure.
  • Ensure that firewalls are connected to a reliable power source. A loss of power during an upgrade can make a firewall unusable.
  • Decide whether to stay in Legacy mode if the Panorama virtual appliance is in Legacy mode on upgrade to PAN-OS 11.1. Legacy mode is not supported for a new Panorama virtual appliance deployment running PAN-OS 9.1 or later release. If you upgrade the Panorama virtual appliance from PAN-OS 9.0 or earlier release to PAN-OS 11.1, Palo Alto Networks recommends reviewing the Setup Prerequisites for the Panorama Virtual Appliance and changing to Panorama mode or Management Only mode based on your needs.
    If you want to keep the Panorama virtual appliance in Legacy mode, increase CPUs and memory allocated to the Panorama virtual appliance to a minimum 16 CPUs and 32GB memory to successfully upgrade to PAN-OS 11.1. See the Setup Prerequisites for the Panorama Virtual Appliance for more information.
  1. Save a backup of the current configuration file on each managed firewall you plan to upgrade.
    Although the firewall automatically creates a configuration backup, it is a best practice to create and externally store a backup before you upgrade.
    1. Select
      Panorama
      Setup
      Operations
      and click
      Export Panorama and devices config bundle
      to generate and export the latest configuration backup of Panorama and of each managed appliance.
    2. Save the exported file to a location external to the firewall. You can use this backup to restore the configuration if you have problems with the upgrade.
  2. Install the latest content update.
    Refer to the Release Notes for the minimum content release version required for PAN-OS 11.1. Make sure to follow the Best Practices for Applications and Threats Content Updates when deploying content updates to Panorama and managed firewalls.
    1. Select
      Panorama
      Device Deployment
      Dynamic Updates
      and
      Check Now
      for the latest updates. If an update is available, the Action column displays a
      Download
      link.
    2. Click
      Install
      and select the firewalls on which you want to install the update. If you are upgrading HA firewalls, you must update content on both peers.
    3. Click
      OK
  3. Review the PAN-OS Upgrade Checklist, the known issues and changes to default behavior in the Release Notes and upgrade/downgrade considerations for each release through which you pass as part of your upgrade path.
    If upgrading more than one firewall, streamline the process by determining upgrade paths for all firewalls before you start downloading images.
  4. (
    Best Practices
    ) If you are leveraging Cortex Data Lake (CDL), install the device certificate.
    The firewall automatically switches to using the device certificate for authentication with CDL ingestion and query endpoints on upgrade to PAN-OS 11.1.
    If you do not install the device certificate prior to upgrade to PAN-OS 11.1, the firewall continues to use the existing logging service certificates for authentication.
  5. (HA firewall upgrades only)
    If you will be upgrading firewalls that are part of an HA pair, disable preemption. You need only disable this setting on one firewall in each HA pair.
    1. Select
      Device
      High Availability
      and edit the
      Election Settings
      .
    2. If enabled, disable (clear) the
      Preemptive
      setting and click
      OK
      .
    3. Commit
      your change. Make sure the commit is successful before you proceed with the upgrade.
  6. (
    HA firewall upgrades only
    ) Suspend the primary HA peer to force a failover.
    (
    Active/passive firewalls
    ) For firewalls in an active/passive HA configuration, suspend and upgrade the active HA peer first.
    (
    Active/active firewalls
    ) For firewalls in an active/active HA configuration, suspend and upgrade the active-primary HA peer first.
    1. Log in to the firewall web interface of active primary firewall HA peer.
    2. Select
      Device
      High Availability
      Operational Commands
      and
      Suspend local device for high availability
      .
    3. In the bottom-right corner, verify that the state is
      suspended
      .
      The resulting failover should cause the secondary passive HA peer to transition to
      active
      state.
      The resulting failover verifies that HA failover is functioning properly before you upgrade.
  7. The skip software version upgrade feature supports managed firewalls running PAN-OS 10.1 or later releases. If your managed firewalls are on PAN-OS 10.0 or an earlier release, first upgrade to PAN-OS 10.1 or a later release.
  8. (
    Optional
    )
    Export
    the file to a configured SCP server.
    In PAN-OS 11.1, SCP servers are available as a download source when deploying upgrades to managed firewalls. Export the file before downloading the software and content images in the next step.
  9. Validate and download the software and content versions required for the target release.
    In this step, you’re able to both view and download the intermediate software and content images required to upgrade to PAN-OS 11.1.
    Downloading software and content images using multi-image download is optional. You can still download images one at a time.
    1. Click
      Panorama
      Device Deployment
      Software
      Action
      Validate
      .
    2. View the intermediate software and content versions you need to download.
    3. Select the firewalls you want to upgrade and click
      Deploy
      .
    4. Select a download source and click
      Download
      .
  10. Install PAN-OS 11.1.0 on the firewalls.
    (
    SD-WAN only
    ) To preserve an accurate status for your SD-WAN links, you must upgrade your hub firewalls to PAN-OS 11.1 before you upgrade your branch firewalls. Upgrading branch firewalls before hub firewalls may result in incorrect monitoring data (
    Panorama
    SD-WAN
    Monitoring
    ) and for SD-WAN links to erroneously display as
    down
    .
    1. Click
      Install
      in the Action column that corresponds to the firewall models you want to upgrade. For example, if you want to upgrade your PA-440 firewalls, click
      Install
      in the row that corresponds to PanOS_440-11.1.0.
    2. In the Deploy Software file dialog, select all firewalls that you want to upgrade.
      (
      HA firewall upgrades only
      ) To reduce downtime, select only one peer in each HA pair. For active/passive pairs, select the passive peer; for active/active pairs, select the active-secondary peer.
    3. (HA firewall upgrades only)
      Make sure
      Group HA Peers
      is not selected.
    4. Select
      Reboot device after install
      .
    5. To begin the upgrade, click
      OK
      .
    6. After the installation completes successfully, reboot using one of the following methods:
      • If you are prompted to reboot, click
        Yes
        .
      • If you are not prompted to reboot, select
        Device
        Setup
        Operations
        and
        Reboot Device
        .
    7. After the firewalls finish rebooting, select
      Panorama
      Managed Devices
      and verify the Software Version is 11.1.0 for the firewalls you upgraded. Also verify that the HA status of any passive firewalls you upgraded is still passive.
  11. (
    HA firewall upgrades only
    ) Restore HA functionality to the primary HA peer.
    1. Log in to the firewall web interface of suspended primary firewall HA peer.
    2. Select
      Device
      High Availability
      Operational Commands
      and
      Make local device functional for high availability
      .
    3. In the bottom-right corner, verify that the state is
      Passive
      . For firewalls in an active/active configuration, verify that the state is
      Active
      .
    4. Wait for the HA peer running configuration to synchronize.
      In the
      Dashboard
      , monitor the Running Config status in the High Availability widget.
  12. (
    HA firewall upgrades only
    ) Suspend the secondary HA peer to force a failover back to the primary HA peer.
    1. Log in to the firewall web interface of active secondary firewall HA peer.
    2. Select
      Device
      High Availability
      Operational Commands
      and
      Suspend local device for high availability
      .
    3. In the bottom-right corner, verify that the state is
      suspended
      .
      The resulting failover should cause the primary passive HA peer to transition to
      active
      state.
      The resulting failover verifies that HA failover is functioning properly before you upgrade.
  13. (HA firewall upgrades only)
    Upgrade the second HA peer in each HA pair.
    1. In the Panorama web interface, select
      Panorama
      Device Deployment
      Software
      .
    2. Click
      Install
      in the Action column that corresponds to the firewall models of the HA pairs you are upgrading.
    3. In the Deploy Software file dialog, select all firewalls that you want to upgrade. This time, select only the peers of the HA firewalls you just upgraded.
    4. Make sure
      Group HA Peers
      is not selected.
    5. Select
      Reboot device after install
      .
    6. To begin the upgrade, click
      OK
      .
    7. After the installation completes successfully, reboot using one of the following methods:
      • If you are prompted to reboot, click
        Yes
        .
      • If you are not prompted to reboot, select
        Device
        Setup
        Operations
        and
        Reboot Device
        .
  14. (
    HA firewall upgrades only
    ) Restore HA functionality to the secondary HA peer.
    1. Log in to the firewall web interface of suspended secondary firewall HA peer.
    2. Select
      Device
      High Availability
      Operational Commands
      and
      Make local device functional for high availability
      .
    3. In the bottom-right corner, verify that the state is
      Passive
      . For firewalls in an active/active configuration, verify that the state is
      Active
      .
    4. Wait for the HA peer running configuration to synchronize.
      In the
      Dashboard
      , monitor the Running Config status in the High Availability widget.
  15. Upgrading a managed firewall in FIPS-CC mode requires you to reset the secure connection status if you added the Dedicated Log Collector to Panorama management while the managed firewall was running a PAN-OS 11.1 release.
    You do not need to re-onboard the managed firewall added to Panorama management while the managed firewall was running a PAN-OS 10.0 or earlier release.
  16. Verify the software and content release version running on each managed firewall.
    1. On Panorama, select
      Panorama
      Managed Devices
      .
    2. Locate the firewalls and review the content and software versions in the table.
      For HA firewalls, you can also verify that the HA Status of each peer is as expected.
  17. (HA firewall upgrades only)
    If you disabled preemption on one of your HA firewalls before you upgraded, then edit the
    Election Settings
    (
    Device
    High Availability
    ) and re-enable the
    Preemptive
    setting for that firewall and then
    Commit
    the change.
  18. On the Panorama web interface, push the entire Panorama managed configuration to your managed firewalls.
    This step is required to enable selective commit and push of device group and template stack configuration changes from Panorama to your managed firewalls.
    This is required to successfully push configuration changes to multi-vsys firewalls managed by Panorama after successful upgrade to PAN-OS 11.1 from PAN-OS 10.1 or earlier release. For more information, see the change to default behavior for shared configuration objects for multi-vsys firewalls managed by Panorama.
    1. Select
      Commit
      Push to Devices
      .
    2. Push
      .
  19. Regenerate or re-import all certificates to adhere to OpenSSL Security Level 2.
    On upgrade to PAN-OS 11.1 or later release, it is required that all certificates meet the following minimum requirements. Skip this step if you are upgrading from PAN-OS 10.2 and have already regenerated or re-imported your certificates.
    • RSA 2048 bits or greater, or ECDSA 256 bits or greater
    • Digest of SHA256 or greater
    See the PAN-OS Administrator's Guide or Panorama Administrator's Guide for more information on regenerating or re-importing your certificates.
  20. View the software upgrade history of the firewall.
    1. Log into the Panorama interface.
    2. Go to
      Panorama
      Managed Devices
      Summary
      and click
      Device History
      .

Recommended For You