Upgrade a Standalone Firewall to PAN-OS 8.1
Review the PAN-OS 8.1 Release Notes and then use the following procedure to upgrade a firewall that is not in an HA configuration to PAN-OS 8.1.
If your firewalls are configured to forward samples to a WF-500 appliance for analysis, you must upgrade the WildFire appliance to PAN-OS 8.1 before upgrading the forwarding firewalls.
To avoid impacting traffic, plan to upgrade within the outage window. Ensure the firewall is connected to a reliable power source. A loss of power during an upgrade can make the firewall unusable.
- Save a backup of the current configuration file.Although the firewall automatically creates a configuration backup, it is a best practice to create and externally store a backup before you upgrade.
- Select DeviceSetupOperations and click Export named configuration snapshot.
- Select the XML file that contains your running configuration (for example, running-config.xml) and click OK to export the configuration file.
- Save the exported file to a location external to the firewall. You can use this backup to restore the configuration if you have problems with the upgrade.
- If you have enabled User-ID, after you upgrade, the firewall
clears the current IP address-to-username and group mappings so
that they can be repopulated with the attributes from the User-ID
sources. To estimate the time required for your environment to repopulate
the mappings, run the following CLI commands on the firewall.
- For IP address-to-username mappings:
- show user user-id-agent state all
- show user server-monitor state all
- For group mappings: show user group-mapping statistics
- Ensure that the firewall is running the latest content
release version.Refer to the Release Notes for the minimum content release version you must install for a PAN-OS 8.1 release. Make sure to follow the Best Practices for Application and Threat Content Updates.
- Select DeviceDynamic Updates and check which Applications or Applications
and Threats to determine which update is Currently Installed.
- If the firewall is not running the minimum required content release version or a later version required for PAN-OS 8.1, Check Now to retrieve a list of available updates.
- Locate and Download the desired
content release version.After you successfully download a content update file, the link in the Action column changes from Download to Install for that content release version.
- Install the update.
- Select DeviceDynamic Updates and check which Applications or Applications and Threats to determine which update is Currently Installed.
- Determine the
Upgrade Path to PAN-OS 8.1You cannot skip installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 8.1.0.
to PAN-OS 8.1.
- Select DeviceSoftware and click Check Now to display the latest PAN-OS updates.
- Locate and Download PAN-OS 8.1.0.
- After you download the image (or, for a manual upgrade, after you upload the image), Install the image.
the installation completes successfully, reboot using one of the
At this point, the firewall clears the User-ID mappings, then connects to the User-ID sources to repopulate the mappings.
- If you are prompted to reboot, click Yes.
- If you are not prompted to reboot, select DeviceSetupOperations and click Reboot Device.
- If you have enabled User-ID, use the following CLI
commands to verify that the firewall has repopulated the IP address-to-username
and group mappings before allowing traffic.
- show user ip-user-mapping all
- show user group list
- Verify that the firewall is passing traffic.Select MonitorSession Browser and verify that you are seeing new sessions.
Upgrade an HA Firewall Pair to PAN-OS 8.1
Upgrade an HA Firewall Pair to PAN-OS 8.1 Review the PAN-OS 8.1 Release Notes and then use the following procedure to upgrade a pair of ...
Upgrade Firewalls When Panorama is Internet-Connected
Procedure to upgrade managed firewalls when Panorama is Internet connected. ...
Upgrade Log Collectors When Panorama Is Internet-Connected
Upgrade Log Collector software to PAN-OS® 8.1 and install content updates using Panorama™ when Panorama is connected to the internet. ...
Determine the Upgrade Path to PAN-OS 8.1
Determine the Upgrade Path to PAN-OS 8.1 When you upgrade from one PAN-OS feature release version to a later feature release, you cannot skip the ...
Upgrade Firewalls Using Panorama
Upgrade Firewalls Using Panorama Review the PAN-OS 8.1 Release Notes and then use the following procedure to upgrade firewalls that you manage with Panorama. This ...
Install Updates for Panorama When Not Internet-Connected
Install Updates for Panorama When Not Internet-Connected If Panorama™ does not have a direct connection to the internet, perform the following steps to install Panorama ...
Upgrade the Firewall to PAN-OS 8.1
Upgrade the Firewall to PAN-OS 8.1 How you upgrade to PAN-OS 8.1 depends on whether you have standalone firewalls or firewalls in a high availability ...
Upgrade Firewalls When Panorama Is Not Internet-Connected
Upgrade firewall software to PAN-OS® 8.1 and install content updates using Panorama™ when Panorama is not connected to the internet. ...
Install Updates for Panorama with an Internet Connection
Install Updates for Panorama with an Internet Connection If Panorama™ has a direct connection to the internet, perform the following steps to install Panorama software ...