Document:PAN-OS® Web Interface Reference Guide

Panorama > Device Deployment

Search the Table of Contents

Select Panorama > Device Deployment to display current deployment information for the managed firewalls. They also enable you to manage software and content updates, manage licenses, and schedule content updates on the managed firewalls and Log Collectors.

What do you want to know?	See:
Deploy updates to firewalls and Log Collectors.	Manage Software and Content Updates
See which updates are installed or available for download and installation.	Display Software and Content Update Information
Schedule automatic content updates for firewalls and Log Collectors	Schedule Dynamic Content Updates
View, activate, deactivate, and refresh licenses. See the status of firewall licenses.	Manage Firewall Licenses
Looking for more?	Manage Licenses and Updates

Manage Software and Content Updates

Panorama > Device Deployment > Software

Select Panorama > Device Deployment > Software to deploy software and content updates to managed firewalls and Log Collectors.

Panorama Device Deployment Option	Description
Download	To deploy a software or content update when Panorama is connected to the Internet, Download the update. When the download finishes, the Available column displays Downloaded. You can then: Install the PAN-OS/Panorama software update or content update. Activate the GlobalProtect Client (GlobalProtect agent/app) or SSL VPN Client software update.
Upgrade	If a BrightCloud URL Filtering content update is available, click Upgrade. After a successful upgrade, you can Install the update on firewalls.
Install	After you download or upload a PAN-OS software, Panorama software, or content update (see Manage Software and Content Updates), click Install in the Action column and select: Devices —Select the firewalls or Log Collectors on which to install the update. If the list is long, use the Filters. Select Group HA Peers to group firewalls that are high availability (HA) peers. This option enables you to easily identify firewalls that have an HA configuration. To display only specific firewalls or Log Collectors, select them and then Filter Selected. Upload only to device ( software only )—Select this option to load the software without automatically installing it. You must manually install the software. Reboot device after install ( software only )—Select this option if you want the installation process to automatically reboot the firewalls or Log Collectors. The installation cannot finish until a reboot occurs. Disable new apps in content update ( Applications and Threats only )—Select this option to disable applications in the update that are new relative to the last installed update. This protects against the latest threats while giving you the flexibility to enable applications after preparing any policy updates. Then, to enable applications, log in to the firewall, select Device > Dynamic Updates, click Apps in the Features column to display the new applications, and click Enable/Disable for each application you want to enable. You can also select Panorama > Managed Devices to install Firewall Software and Content Updates or Panorama > Managed Collectors to Install a Software Update on a Log Collector.
Activate	After you download or upload a GlobalProtect Client (GlobalProtect agent/app) or SSL VPN Client software update (see Manage Software and Content Updates), click Activate in the Action column and select the options as follows: Devices —Select the firewalls on which to activate the update. If the list is long, use the Filters. Select Group HA Peers to group firewalls that are high availability (HA) peers. This option enables you to easily identify firewalls that have an HA configuration. To display only specific firewalls, select them and then Filter Selected. Upload only to device —Select this option if you don’t want PAN-OS to automatically activate the uploaded image. You must log in to the firewall and activate it.
Release Notes	Click Release Notes to access the release notes for the desired software release and review the release changes, fixes, known issues, compatibility issues, and changes in default behavior.
Documentation	Click Documentation to access the release notes for the desired content release.
	Deletes software or content updates when no longer needed or when you want to free up space for more downloads or uploads.
Check Now	Check Now to Display Software and Content Update Information.
Upload	To deploy a software or content update when Panorama is not connected to the Internet, download the update to your computer from the Software Updates or Dynamic Updates site, select the Panorama > Device Deployment page that corresponds to the update type, click Upload, select the update Type ( content updates only ), select the uploaded file, and click OK. The steps to then install or activate the update depend on the type: PAN-OS or Panorama software —When the upload is complete, the Available column displays Uploaded. You can then install the software update. GlobalProtect Client or SSL VPN Client software —Activate from file. Dynamic updates —Install from file.
Install from File	After you upload a content update, click Install from File, select the content Type, select the filename of the update, and select the firewalls or Log Collectors.
Activate from File	After you upload a GlobalProtect Client (GlobalProtect agent/app) or SSL VPN Client software update, click Activate from File, select the filename of the update, and select the firewalls.
Schedules	Select this option to Schedule Dynamic Content Updates.

Display Software and Content Update Information

Panorama > Device Deployment > Software

Select Panorama > Device Deployment > Software to display PAN-OS Software, SSL VPN Client software, GlobalProtect Client software, and Dynamic Updates (content) currently installed or available for download and installation. The Dynamic Updates page organizes the information by content type (Antivirus, Applications and Threats, URL Filtering, and WildFire) and indicates the date and time of the last check for updated information. To display the latest software or content information from Palo Alto Networks, click Check Now.

Software and Content Update Information	Description
Version	The software or content update version.
File Name	The name of the update file.
Platform	The designated firewall or Log Collector platform for the update. A number indicates a hardware firewall platform (for example, 7000 indicates the PA-7000 Series firewall), vm indicates the VM-Series firewall, and m indicates the M-Series appliance.
Features	( Content only ) Lists the type of signatures the content version might include.
Type	( Content only ) Indicates whether the download includes a full database update or an incremental update.
Size	The size of the update file.
Release Date	The date and time when Palo Alto Networks made the update available.
Available	( PAN-OS or Panorama software only ) Indicates that the update is downloaded or uploaded.
Downloaded	( SSL VPN Client software, GlobalProtect Client software, or content only ) A check mark indicates that the update is downloaded.
Action	Indicates the action you can perform on the update—Download, Upgrade, Install, or Activate.
Documentation	( Content only ) Provides a link to the release notes for the desired content release.
Release Notes	( Software only ) Provides a link to the release notes for the desired software release.
	Deletes an update when no longer needed or when you want to free up space for more downloads or uploads.

Schedule Dynamic Content Updates

Panorama > Device Deployment > Dynamic Updates

To schedule an automatic download and installation of an update

, click Schedules, click Add, and complete the following fields.

Dynamic Update Schedule Setting	Description
Name	Enter a name to identify the scheduled job (up to 31 characters). The name is case-sensitive and must be unique. Use only letters, numbers, hyphens, and underscores.
Disabled	Select this option to disable the scheduled job.
Type	Select the type of content update to schedule— App, App and Threat, Antivirus, WildFire, or URL Database.
Recurrence	Select the interval at which Panorama checks in with the update server. The recurrence options vary by update type.
Time	For a Daily update, select the Time from the 24-hour clock. For a Weekly update, select the Day of week, and the Time from the 24-hour clock.
Disable new apps in content update	You can select this option only if you set the update Type to App or App and Threat and only if Action is set to Download and Install. Select this option to disable applications in the update that are new relative to the last installed update. This protects against the latest threats while giving you the flexibility to enable the applications after preparing any policy updates. Then, to enable applications, log in to the firewall, select Device > Dynamic Updates, click Apps in the Features column to display the new applications, and click Enable/Disable for each application you want to enable.
Action	Download Only —Panorama will download the scheduled update. You must manually “Install” the update on firewalls and Log Collectors. Download and Install —Panorama will download and automatically install the scheduled update.
Devices	Select Devices and then select the firewalls that will receive scheduled content updates.
Log Collectors	Select Log Collectors and then select the managed collectors that will receive scheduled content updates.

Manage Firewall Licenses

Panorama > Device Deployment > Licenses

Select Panorama > Device Deployment > Licenses to perform the following tasks:

Update licenses of firewalls that don’t have direct internet access—Click Refresh. Activate a license on firewalls—To activate a license on firewalls, click Activate, select the firewalls and, in the Auth Code column, enter the authorization codes that Palo Alto Networks provided for the firewalls. Deactivate all the licenses and subscriptions/entitlements installed on VM-Series firewalls—Click Deactivate VMs, select the firewalls (the list displays only firewalls running PAN-OS 7.0 or later releases), and click: Continue —Deactivates the licenses and automatically registers the changes with the licensing server. The licenses are credited back to your account and are available for reuse. Complete Manually —Generates a token file. Use this option if Panorama does not have direct Internet access. To complete the deactivation process, you must log in to the Support portal, select Assets, click Deactivate License(s), upload the token file, and click Submit. After you complete the deactivation process.

You can also view the current license status for managed firewalls. For firewalls that have direct internet access, Panorama automatically performs a daily check-in with the licensing server, retrieves license updates and renewals, and pushes them to the firewalls. The check-in is hard-coded to occur between 1 and 2 A.M.; you cannot change this schedule.

Firewall License Information	Description
Device	The firewall name.
Virtual System	Indicates whether the firewall does or does not support multiple virtual systems.
Threat Prevention	Indicates whether the license is active , inactive , or expired (along with the expiration date).
URL
Support
GlobalProtect Gateway
GlobalProtect Portal
WildFire
VM-Series Capacity	Indicates whether this is or is not a VM-Series firewall.

Document:PAN-OS® Web Interface Reference Guide

Panorama > Device Deployment

Table of Contents

Recommended For You

Recommended Videos