Upgrade Panorama with an Internet Connection

1. Determine the Upgrade Path to PAN-OS 11.1.
2. (Panorama Interconnect plugin only) Synchronize the Panorama Node with the Panorama Controller.

   Before you begin upgrading a Panorama Node, you must synchronize the Panorama Controller and Panorama Node configuration. This is required to successfully push the common Panorama Controller configuration to your Panorama Node after successful upgrade.
3. Save a backup of the current Panorama configuration file that you can use to restore the configuration if you have problems with the upgrade.

   Although Panorama automatically creates a backup of the configuration, best practice is to create and externally store a backup before you upgrade.

   1. Log in to the Panorama web interface.
   2. Save named Panorama configuration snapshot (PanoramaSetupOperations), enter a Name for the configuration, and click OK.
   3. Export named Panorama configuration snapshot, select the Name of the configuration you just saved, click OK, and save the exported file to a location that is external to Panorama.
4. (Best Practices) If you are leveraging Strata Logging Service, install the Panorama device certificate.

   Panorama automatically switches to using the device certificate for authentication with Strata Logging Service ingestion and query endpoints on upgrade to PAN-OS 11.1.

   If you do not install the device certificate prior to upgrade to PAN-OS 11.1, Panorama continues to use the existing logging service certificate for authentication.
5. Enable the following TCP ports on your network.

   These TCP ports must be enabled on your network to allow inter-Log Collector communication.

   • TCP/9300
   • TCP/9301
   • TCP/9302
6. Install the latest content updates.

   If Panorama is not running the minimum content versions required for the Panorama release to which you intend to upgrade, you must update content versions to the minimum (or later) versions before you install the software updates. Refer to Release Notes for minimum content release version for a Panorama release.

   If you intend to upgrade Log Collectors and firewalls to a particular release, you must first upgrade Panorama to that (or a later) release.

   For a Panorama virtual appliance that runs on a hypervisor, ensure that the instance meets the Setup Prerequisites for the Panorama Virtual Appliance.

   Palo Alto Networks® highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version. Additionally, we recommend that you schedule automatic, recurring updates so that you are always running the latest content versions (refer to 16).

   1. Select PanoramaDynamic Updates and Check Now for the latest updates. If the value in the Action column is Download, an update is available.

      Ensure that Panorama is running the same but not a later content release version than is running on managed firewalls and Log Collectors.
   2. (Before you update the content release version on Panorama, be sure to Upgrade the Firewall to PAN-OS 11.1 from Panorama and then Log Collectors (see Upgrade Log Collectors When Panorama Is Internet-Connected) to the same (or a later) content release version.

      If you do not need to install content updates at this time, then skip ahead to the next step.
   3. Install remaining content updates, as needed. When installed, the Currently Installed column displays a check mark.

      1. Download and Install the Applications or Applications and Threats update. Regardless of your subscription, Panorama installs and needs only the Applications content update, not the Threats content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
      2. Download and Install other updates (Antivirus, WildFire®, or URL Filtering) as needed, one at a time, and in any sequence.
7. Select PanoramaPlugins and Download the plugin version supported on PAN-OS 11.1 for all plugins currently installed on Panorama.

   See the Compatibility Matrix for the Panorama plugin version supported for your target PAN-OS 11.1 release.

   This is required to successfully upgrade Panorama from PAN-OS 11.0 to PAN-OS 11.1. Upgrade to PAN-OS 11.1 is blocked if the supported plugin version is not downloaded.

   The downloaded plugins required to upgrade to PAN-OS 11.1 automatically install after Panorama successfully upgrades to PAN-OS 11.1. If a downloaded plugin does not automatically install, you must manually install the impacted plugin after upgrade to PAN-OS 11.1.
8. Upgrade Panorama to PAN-OS 11.1.

   1. Check Now (PanoramaSoftware) for the latest releases.

      (PAN-OS 11.1.3 and later releases) By default, the preferred releases and the corresponding base releases are displayed. To view the preferred releases only, disable (clear) the Base Releases checkbox. Similarly, to view the base releases only, disable (clear) the Preferred Releases checkbox.
   2. Locate and validate the PAN-OS 11.1.0 image.

      1. Click PanoramaSoftwareActionValidate.
      2. Select the required dependencies, and click Download.
   3. (Panorama mode only) A notification is displayed if you have local Log Collector that contains logs generated in PAN-OS 10.0 or earlier releases.

      This notification is displayed the first time you attempt to Install PAN-OS 11.1.2 or later 11.1 release and is not displayed a second time after the notification is closed. It warns you that logs generated by Panorama or managed devices when running PAN-OS 10.0 or earlier release are detected and will be deleted on upgrade. This means that the impacted logs are not viewable or searchable after successful upgrade.

      However, you can recover these impacted logs after upgrade. The notification also provides you with the following information:

      • Impacted log types.
      • Impacted time frames for each log type.
      • Each debug logdb migrate-lc command required to recover the impacted logs for each log type.
        Copy the listed debug logdb migrate-lc before you Close the notification.

      Close the notification.
   4. Install the downloaded image and then reboot.

      1. Install the image.
      2. After the installation completes successfully, reboot using one of the following methods:
         • If prompted to reboot, click Yes. If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the username and password you specified during initial configuration.
         • If you are not prompted to reboot, Reboot Panorama from the Device Operations section (PanoramaSetupOperations).

      Continue to the next step after Panorama successfully reboots.
9. (PAN-OS 11.1.2 and later releases; Panorama mode only) Log in to the Panorama CLI and recover the impacted logs using the debug logdb migrate-lc commands listed in the previous step.

   These commands must be run sequentially and cannot be run simultaneously. If you didn't copy the debug logdb migrate-lc commands from the notification window, click Tasks and view the failed Install job details.
10. Verify that your Panorama plugin versions are supported PAN-OS 11.1.

    You must verify and install Panorama plugin version supported on PAN-OS 11.1 after you successfully upgrade Panorama. See the Compatibility Matrix for more information about supported Panorama plugins supported on PAN-OS 11.1.

    1. Log in to the Panorama web interface and review the General Information widget in the Dashboard to verify the PAN-OS 11.1 compatible plugin versions successfully installed.

       You can also log in to the Panorama CLI and enter the command show plugins installed to view the list of currently installed plugins.
    2. Select PanoramaPlugins and search for the plugin that did not install.
    3. Install the plugin version supported on PAN-OS 11.1.
    4. Repeat the steps above until all plugins installed on Panorama are running the version supported on PAN-OS 11.1.
11. (If local Log Collector is in a Collector Group) Upgrade the remaining Log Collectors in the Collector Group.

    • Upgrade Log Collectors When Panorama Is Internet-Connected
    • Upgrade Log Collectors When Panorama Is Not Internet-Connected
12. (Panorama and managed devices in FIPS-CC mode) Upgrade Panorama and Managed Devices in FIPS-CC Mode.

    Upgrading Panorama and managed devices in FIPS-CC mode requires you to reset the secure connection status of the devices in FIPS-CC mode if added to Panorama management while running a PAN-OS 11.1 release. You need to re-onboard the following managed devices to Panorama management:

    • Managed devices in FIPS-CC mode added to Panorama using the device registration authentication key.
    • Managed devices in the normal operational mode added to Panorama using the device registration authentication key

    You do not need to re-onboard managed devices added to Panorama management while the managed device was running a PAN-OS 10.0 or earlier release.
13. Regenerate or re-import all certificates to adhere to OpenSSL Security Level 2.

    This step is required if you upgrade from PAN-OS 10.1 or earlier release to PAN-OS 11.1. Skip this step if you upgrade from PAN-OS 10.2 and have already regenerated or re-imported your certificates.

    It is required that all certificates meet the following minimum requirements:

    • RSA 2048 bits or greater, or ECDSA 256 bits or greater
    • Digest of SHA256 or greater

    See the PAN-OS Administrator's Guide or Panorama Administrator's Guide for more information on regenerating or re-importing your certificates.
14. (Recommended for Panorama mode) Increase the memory of the Panorama virtual appliance to 64GB.

    After you successfully upgrade the Panorama virtual appliance in Panorama mode to PAN-OS 11.1, Palo Alto Networks recommends increasing the memory of the Panorama virtual appliance to 64GB to meet the increased system requirements to avoid any logging, management, and operational performance issues related to an under-provisioned Panorama virtual appliance.
15. Select CommitCommit and Push and Commit and Push the Panorama managed configuration to all managed devices.

    After you successfully upgrade Panorama and managed devices to PAN-OS 11.1, a full commit and push of the Panorama managed configuration is required before you can push selective configuration to your managed devices and leverage the improved shared configuration object management for multi-vsys firewalls managed by Panorama.
16. (Best Practice) Schedule recurring, automatic content updates.

    Panorama does not synchronize content update schedules across HA peers. You must perform this task on both the active and passive Panorama.

    In the header row for each update type (PanoramaDynamic Updates), the Schedule is initially set to None. Perform the following steps for each update type.

    1. Click None and select the update frequency (Recurrence). The frequency options depend on the update type.
    2. Select the schedule action:

       • Download And Install (Best Practice)—Panorama automatically installs updates after downloading them.
         Download Only—You must manually install updates after Panorama downloads them.
    3. Based on the best practices for the security posture of your organization, configure a delay (Threshold) after an update becomes available before Panorama downloads the update.
    4. Click OK to save your changes.
    5. Select CommitCommit to Panorama and Commit your changes.