Manage Software and Content Updates

  • Panorama > Device Deployment > Software
Panorama provides the following options for deploying software and content updates to firewalls and Log Collectors.
To reduce traffic on the management (MGT) interface, you can configure Panorama to use a separate interface for deploying updates (see Panorama > Setup > Interfaces).
Panorama Device Deployment Options
Description
Download
To deploy a software or content update when Panorama is connected to the Internet,
Download
the update. When the download finishes, the Available column displays Downloaded. You can then:
  • Install the PAN-OS/Panorama software update or content update.
  • Activate the GlobalProtect™ app or SSL VPN Client software update.
Upgrade
If a BrightCloud URL Filtering content update is available, click
Upgrade
. After a successful upgrade, you can Install the update on firewalls.
Install
After you Download or Upload a PAN-OS software, Panorama software, or content update, click
Install
in the Action column and select:
  • Devices
    —Select the firewalls or Log Collectors on which to install the update. If the list is long, use the Filters. Select
    Group HA Peers
    to group firewalls that are high availability (HA) peers. This enables you to easily identify firewalls that have an HA configuration. To display only specific firewalls or Log Collectors, select them and then
    Filter Selected
    .
  • Upload only to device
    (
    software only
    )—Select to load the software without automatically installing it. You must manually install the software.
  • Reboot device after install
    (
    software only
    )—Select to specify that the installation process automatically reboots the firewalls or Log Collectors. The installation cannot finish until a reboot occurs.
  • Disable new apps in content update
    (
    Applications and Threats only
    )—Select to disable applications in the update that are new relative to the last installed update. This protects against the latest threats while giving you the flexibility to enable applications after preparing any policy updates. Then, to enable applications, log in to the firewall, select
    Device
    Dynamic Updates
    , click
    Apps
    in the Features column to display the new applications, and click
    Enable/Disable
    for each application you want to enable.
You can also select
Panorama
Managed Devices
to install Firewall Software and Content Updates or
Panorama
Managed Collectors
to install Software Updates for Dedicated Log Collectors.
Activate
After you Download or Upload a GlobalProtect app software update, click
Activate
in the Action column and select the options as follows:
  • Devices
    —Select the firewalls on which to activate the update. If the list is long, use the Filters. Select
    Group HA Peers
    to group firewalls that are high availability (HA) peers. This enables you to easily identify firewalls that have an HA configuration. To display only specific firewalls, select them and then
    Filter Selected
    .
  • Upload only to device
    —Select if you don’t want PAN-OS to automatically activate the uploaded image. You must log in to the firewall and activate it.
Release Notes
Click
Release Notes
to access the release notes for the desired software release and review the release changes, fixes, known issues, compatibility issues, and changes in default behavior.
Documentation
Click
Documentation
to access the release notes for the desired content release.
delete_icon_device.png
Deletes software or content updates when no longer needed or when you want to free up space for more downloads or uploads.
Check Now
Upload
To deploy a software or content update when Panorama is not connected to the Internet, download the update to your computer from the Software Updates or Dynamic Updates site, select the
Panorama
Device Deployment
page that corresponds to the update type, click
Upload
, select the update
Type
(
content updates only
), select the uploaded file, and click
OK
. The steps to then install or activate the update depend on the type:
  • PAN-OS or Panorama software
    —When the upload is complete, the Available column displays Uploaded. You can then install the software update.
  • GlobalProtect Client or SSL VPN Client software
    —Activate from file.
  • Dynamic updates
    —Install from file.
Install from File
After you upload a content update, click
Install from File
, select the content
Type
, select the filename of the update, and select the firewalls or Log Collectors.
Activate from File
After you upload a GlobalProtect app software update, click
Activate from File
, select the filename of the update, and select the firewalls.
Schedules

Related Documentation