Upgrade a Standalone Firewall to PAN-OS 9.0
Follow these steps to upgrade a standalone firewall to PAN-OS 9.0.
Review the PAN-OS 9.0 Release Notes and then use the following procedure to upgrade a firewall that is not in an HA configuration to PAN-OS 9.0.
If your firewalls are configured to forward samples to a WildFire appliance for analysis, you must upgrade the WildFire appliance before upgrading the forwarding firewalls.
To avoid impacting traffic, plan to upgrade within the outage window. Ensure the firewall is connected to a reliable power source. A loss of power during an upgrade can make the firewall unusable.
- Save a backup of the current configuration file.Although the firewall automatically creates a configuration backup, it is a best practice to create and externally store a backup before you upgrade.
- Select DeviceSetupOperations and click Export named configuration snapshot.
- Select the XML file that contains your running configuration (for example, running-config.xml) and click OK to export the configuration file.
- Save the exported file to a location external to the firewall. You can use this backup to restore the configuration if you have problems with the upgrade.
- If you have enabled User-ID, after you upgrade, the firewall
clears the current IP address-to-username and group mappings so
that they can be repopulated with the attributes from the User-ID
sources. To estimate the time required for your environment to repopulate
the mappings, run the following CLI commands on the firewall.
- For IP address-to-username mappings:
- show user user-id-agent state all
- show user server-monitor state all
- For group mappings: show user group-mapping statistics
- Ensure that the firewall is running the latest content
- Select DeviceDynamic Updates and see which Applications or Applications
and Threats content release version is Currently Installed.
- If the firewall is not running the minimum required content release version or a later version required for PAN-OS 9.0, Check Now to retrieve a list of available updates.
- Locate and Download the desired
content release version.After you successfully download a content update file, the link in the Action column changes from Download to Install for that content release version.
- Install the update.
- Select DeviceDynamic Updates and see which Applications or Applications and Threats content release version is Currently Installed.
- Determine the Upgrade Path to PAN-OS 9.0You cannot skip installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 9.0.0.
to PAN-OS 9.0.If your firewall does not have internet access from the management port, you can download the software image from the Palo Alto Networks Customer Support Portal and then manually Upload it to your firewall.
- Select DeviceSoftware and click Check Now to display the latest PAN-OS updates.
- Locate and Download PAN-OS 9.0.0.
- After you download the image (or, for a manual upgrade, after you upload the image), Install the image.
the installation completes successfully, reboot using one of the
At this point, the firewall clears the User-ID mappings, then connects to the User-ID sources to repopulate the mappings.
- If you are prompted to reboot, click Yes.
- If you are not prompted to reboot, select DeviceSetupOperations and click Reboot Device.
- If you have enabled User-ID, use the following CLI
commands to verify that the firewall has repopulated the IP address-to-username
and group mappings before allowing traffic.
- show user ip-user-mapping all
- show user group list
- Verify that the firewall is passing traffic.Select MonitorSession Browser and verify that you are seeing new sessions.
Upgrade the Firewall to PAN-OS 9.0
Determine the upgrade path and upgrade your standalone, HA, and Panorama-managed firewalls to PAN-OS 9.0. ...
Upgrade an HA Firewall Pair to PAN-OS 9.0
Follow these steps to upgrade an HA firewall pair to PAN-OS 9.0. ...
Upgrade Firewalls Using Panorama
Follow these steps to upgrade your Panorama-managed firewalls to PAN-OS 9.0. ...
Determine the Upgrade Path to PAN-OS 9.0
Determine the upgrade path from your current PAN-OS version to PAN-OS 9.0. ...
Install Updates for Panorama with an Internet Connection
Install Updates for Panorama with an Internet Connection If Panorama™ has a direct connection to the internet, perform the following steps to install Panorama software ...
Install Updates for Panorama When Not Internet-Connected
Install Updates for Panorama When Not Internet-Connected If Panorama™ does not have a direct connection to the internet, perform the following steps to install Panorama ...
Upgrade Firewalls When Panorama is Internet-Connected
Procedure to upgrade managed firewalls when Panorama is Internet connected. ...
Upgrade Log Collectors When Panorama Is Internet-Connected
Upgrade Log Collector software to PAN-OS® 8.1 and install content updates using Panorama™ when Panorama is connected to the internet. ...
Upgrade Log Collectors When Panorama Is Not Internet-Connec...
Upgrade Log Collector software to PAN-OS® 8.1 and install content updates using Panorama™ when Panorama is not connected to the internet. ...