: Upgrade Panorama Without an Internet Connection
Focus
Focus

Upgrade Panorama Without an Internet Connection

Table of Contents

Upgrade Panorama Without an Internet Connection

If Panorama™ does not have a direct connection to the internet, perform the following steps to install Panorama software and content updates as needed. If Panorama is deployed in a high availability (HA) configuration, you must upgrade each peer (see Upgrade Panorama in an HA Configuration). If you are upgrading Panorama and managed devices in FIPS-CC mode to PAN-OS 11.1 from PAN-OS 10.2 or earlier release, you must take the additional steps of resetting the secure connection status of the devices in FIPS-CC mode if added to Panorama management while running a PAN-OS 10.2 release. See Upgrade Panorama and Managed Devices in FIPS-CC Mode for more details on upgrading Panorama and FIPS-CC devices in FIPS-CC mode.
Upgrading the software on the Panorama virtual appliance does not change the system mode; switching to Panorama mode or Management Only mode is a manual task that requires additional settings as described when you Set Up the Panorama Virtual Appliance with a Local Log Collector.
Palo Alto Networks introduced new log data formats at different points in your upgrade path depending on the PAN-OS version you are upgrading from.
  • Upgrade from PAN-OS 8.1 to PAN-OS 9.0—PAN-OS 9.0 introduced a new log data format for local and Dedicated Log Collectors. On your upgrade path to PAN-OS 11.1, existing log data is automatically migrated to the new format when you upgrade from PAN-OS 8.1 to PAN-OS 9.0.
  • Upgrade from PAN-OS 10.0 to PAN-OS 10.1—PAN-OS 10.1 introduced a new log format for local and Dedicated Log Collectors. On your upgrade path to PAN-OS 11.1, logs generated in PAN-OS 8.1 or earlier are no longer available. This includes logs migrated as part of the upgrade to PAN-OS 9.0. After upgrade to PAN-OS 10.1, you have the option to recover and migrate these logs to the PAN-OS 10.1 log format.
You must upgrade all Log Collectors in a collector group at the same time to avoid losing log data loss. No log forwarding or log collection occurs if the Log Collectors in a collector group are not all running the same PAN-OS version. Additionally, the log data for the Log Collectors in the collector group is not visible in the ACC or Monitor tabs until all Log Collectors are running the same PAN-OS version. For example, if you have three Log Collectors in a collector group and you upgrade two of the Log Collectors, then no logs are forwarded to any Log Collectors in the collector group.
Before you upgrade Panorama, refer to the Release Notes for the minimum content release version required for PAN-OS® 11.1.
  1. Determine the Upgrade Path to PAN-OS 11.1.
    To skip the installation of any feature release version between the current PAN-OS version and a higher version, ensure that both the base and maintenance releases are available on the same Secure Copy Protocol (SCP) server.
  2. (Panorama Interconnect plugin only) Synchronize the Panorama Node with the Panorama Controller.
    Before you begin upgrading a Panorama Node, you must synchronize the Panorama Controller and Panorama Node configuration. This is required to successfully push the common Panorama Controller configuration to your Panorama Node after successful upgrade.
  3. Save a backup of the current Panorama configuration file that you can use to restore the configuration if you have problems with the upgrade.
    Although Panorama automatically creates a backup of the configuration, best practice is to create and externally store a backup before you upgrade.
    1. Save named Panorama configuration snapshot (PanoramaSetupOperations), enter a Name for the configuration, and click OK.
    2. Export named Panorama configuration snapshot, select the Name of the configuration you just saved, click OK, and save the exported file to a location that is external to Panorama.
  4. Download the latest content updates to a host that can connect and upload content to Panorama either over SCP or HTTPS.
    Palo Alto Networks highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version.
    If you do not need to install content updates at this time, then skip ahead to 6.
    1. Use a host that has internet access to log in to the Palo Alto Networks Customer Support website.
    2. Download content updates as needed:
      1. Click UpdatesDynamic Updates in the Resources section.
      2. Download the appropriate content updates and save the files to the host. Perform this step for each content type you need to update.
  5. Enable the following TCP ports on your network.
    These TCP ports must be enabled on your network to allow inter-Log Collector communication.
    • TCP/9300
    • TCP/9301
    • TCP/9302
  6. Install the latest content updates.
    You must install content updates before software updates and you must Upgrade the Firewall to PAN-OS 11.1 from Panorama first and then upgrade Log Collectors before you install them on the Panorama management server.
    Install the Applications or Applications and Threats update first, and then install any other updates (Antivirus, WildFire®, and URL Filtering), one at a time, and in any sequence.
    Regardless whether your subscription includes both Applications and Threats content, Panorama installs and needs only the Applications content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
    Log in to the Panorama web interface and perform the following steps for each content type:
    1. Select PanoramaDynamic Updates.
    2. Click Upload, select the content Type, Browse to the location on the host to which you downloaded the update, select the update, and click OK.
    3. Install From File, select the Package Type, and click OK.
  7. Upload the plugin version supported on PAN-OS 11.1 for all plugins currently installed on Panorama.
    See the Compatibility Matrix for the Panorama plugin version supported for your target PAN-OS 11.1 release.
    This is required to successfully upgrade Panorama from PAN-OS 11.0 to PAN-OS 11.1. Upgrade to PAN-OS 11.1 is blocked if the supported plugin version is not downloaded.
    The downloaded plugins required to upgrade to PAN-OS 11.1 automatically install after Panorama successfully upgrades to PAN-OS 11.1. If a downloaded plugin does not automatically install, you must manually install the impacted plugin after upgrade to PAN-OS 11.1
    1. Download the plugin version supported on PAN-OS 11.1.
      1. Log in to the Palo Alto Networks Support Portal.
      2. Select UpdatesSoftware Updates and select the plugin from the drop-down menu.
      3. Download the plugin version supported on PAN-OS 10.2.
      4. Repeat this step for all plugins currently installed on Panorama.
    2. Select PanoramaPlugins and Upload the plugin version you downloaded in the previous step.
      Repeat this step for all plugins currently installed on Panorama.
  8. Download the latest PAN-OS 11.1 release image to a host that can connect and upload content to Panorama either over SCP or HTTPS.
    1. Use a host with internet access to log in to the Palo Alto Networks Customer Support web site.
    2. Download software updates:
      1. On the main page of Palo Alto Networks Customer Support website, click UpdatesSoftware Updates.
      2. Locate the model-specific for the latest PAN-OS 11.1 release image. For example, to upgrade an M-Series appliance to Panorama 11.1.0, download the Panorama_m-11.1.0 image; to upgrade a Panorama virtual appliance to Panorama 11.1.0, download the Panorama_pc-11.1.0 image.
        You can quickly locate Panorama images by selecting Panorama M Images (M-Series appliances) or Panorama Updates (virtual appliances) from the Content By drop-down.
        (PAN-OS 11.1.3 and later releases) By default, the results display the preferred releases. In the Release type field, click Other to view the other available releases.
      3. Click the filename and save the file to the host.
  9. Upgrade Panorama to PAN-OS 11.1.
    1. Select PanoramaSoftware and Upload the PAN-OS 11.1 image you downloaded in the previous step.
    2. Browse to the location on the host to which you downloaded the update, select the update, Sync To Peer if Panorama is in an HA configuration (to push the software image to the secondary peer), and click OK.
    3. (Panorama mode only) A notification is displayed if you have a local Log Collector that contains logs generated in PAN-OS 10.0 or earlier releases.
      This notification is displayed the first time you attempt to Install PAN-OS 11.1.2 or later 11.1 release and is not displayed a second time after the notification is closed. It warns you that logs generated by Panorama or managed devices when running PAN-OS 10.0 or earlier release are detected and will be deleted on upgrade. This means that the impacted logs are not viewable or searchable after successful upgrade.
      However, you can recover these impacted logs after upgrade. The notification also provides you with the following information:
      • Impacted log types.
      • Impacted time frames for each log type.
      • Each debug logdb migrate-lc command required to recover the impacted logs for each log type.
        Copy the listed debug logdb migrate-lc before you Close the notification.
      Close the notification.
    4. Install the software image and reboot.
      For an HA configuration, Upgrade Panorama in an HA Configuration; otherwise:
      1. Install the uploaded image.
      2. After you successfully complete the installation, reboot using one of the following methods:
        • If prompted to reboot, click Yes. If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the username and password you specified during initial configuration.
        • If you are not prompted to reboot, Reboot Panorama from the Device Operations section (PanoramaSetupOperations).
      Continue to the next step after Panorama successfully reboots.
  10. (PAN-OS 11.1.2 and later releases; Panorama mode only) Log in to the Panorama CLI and recover the impacted logs using the debug logdb migrate-lc commands listed in the previous step.
    These commands must be run sequentially and cannot be run simultaneously. If you didn't copy the debug logdb migrate-lc commands from the notification window, click Tasks and view the failed Install job details.
  11. Verify that your Panorama plugin versions are supported PAN-OS 11.1.
    You must verify and install Panorama plugin version supported on PAN-OS 11.1 after you successfully upgrade Panorama. See the Compatibility Matrix for more information about supported Panorama plugins supported on PAN-OS 11.1.
    1. Log in to the Panorama web interface and review the General Information widget in the Dashboard to verify the PAN-OS 11.1 compatible plugin versions successfully installed.
      You can also log in to the Panorama CLI and enter the command show plugins installed to view the list of currently installed plugins.
    2. Select PanoramaPlugins and search for the plugin that did not install.
    3. Install the plugin version supported on PAN-OS 11.1.
    4. Repeat the steps above until all plugins installed on Panorama are running the version supported on PAN-OS 11.1.
  12. (If local Log Collector is in a Collector Group) Upgrade the remaining Log Collectors in the Collector Group.
  13. (Recommended for Panorama mode) Increase the memory of the Panorama virtual appliance to 64GB.
    After you successfully upgrade the Panorama virtual appliance in Panorama mode to PAN-OS 11.1, Palo Alto Networks recommends increasing the memory of the Panorama virtual appliance to 64GB to meet the increased system requirements to avoid any logging, management, and operational performance issues related to an under-provisioned Panorama virtual appliance.
  14. (Panorama and managed devices in FIPS-CC mode) Upgrade Panorama and Managed Devices in FIPS-CC Mode.
    Upgrading Panorama and managed devices in FIPS-CC mode requires you to reset the secure connection status of the devices in FIPS-CC mode if added to Panorama management while running a PAN-OS 11.1 release. You need to re-onboard the following managed devices to Panorama management:
    • Managed devices in FIPS-CC mode added to Panorama using the device registration authentication key.
    • Managed devices in the normal operational mode added to Panorama using the device registration authentication key
    You do not need to re-onboard managed devices added to Panorama management while the managed device was running a PAN-OS 10.0 or earlier release.
  15. (PAN-OS 10.2 and later releases) Regenerate or re-import all certificates to adhere to OpenSSL Security Level 2.
    This step is required if you upgrade from PAN-OS 10.1 or earlier release to PAN-OS 11.1. Skip this step if you upgrade from PAN-OS 10.2 and have already regenerated or re-imported your certificates.
    It is required that all certificates meet the following minimum requirements:
    • RSA 2048 bits or greater, or ECDSA 256 bits or greater
    • Digest of SHA256 or greater
    See the PAN-OS Administrator's Guide or Panorama Administrator's Guide for more information on regenerating or re-importing your certificates.
  16. Select CommitCommit and Push and Commit and Push the Panorama managed configuration to all managed devices.
    After you successfully upgrade Panorama and managed devices to PAN-OS 11.1, a full commit and push of the Panorama managed configuration is required before you can push selective configuration to your managed devices and leverage the improved shared configuration object management for multi-vsys firewalls managed by Panorama.