Upgrade Firewalls Using Panorama
Follow these steps to upgrade your Panorama-managed firewalls
to PAN-OS 9.1.
Review the PAN-OS 9.1 Release Notes and
then use the following procedure to upgrade firewalls that you manage
with Panorama. This procedure applies to standalone firewalls and
firewalls deployed in a high availability (HA) configuration.
When
upgrading HA firewalls across multiple feature PAN-OS releases,
you must upgrade each HA peer to the same feature PAN-OS release
on your upgrade path before continuing. For example, you are upgrading
HA peers from PAN-OS 8.1 to PAN-OS 9.1. You must upgrade both HA
peers to PAN-OS 9.0 before you can continue upgrading to the target
PAN-OS 9.1 release. When HA peers are two or more feature releases
apart, the firewall with the older release installed enters a
suspended
state
with the message Peer version too old
.If Panorama is unable to connect directly
to the update server, follow the procedure for deploying updates to firewalls
when Panorama is not internet-connected so that you can manually
download images to Panorama and then distribute the images to firewalls.
Before
you can upgrade firewalls from Panorama, you must:
- Make sure Panorama is running the same or a later PAN-OS version than you are upgrading to. You must upgrade Panorama and its Log Collectors to 9.1 before upgrading the managed firewalls to this version. In addition, when upgrading Log Collectors to 9.1, you must upgrade all Log Collectors at the same time due to changes in the logging infrastructure.
- Plan for an extended maintenance window of up to six hours when upgrading Panorama to 9.1. This release includes significant infrastructure changes, which means that the Panorama upgrade will take longer than in previous releases.
- Ensure that firewalls are connected to a reliable power source. A loss of power during an upgrade can make a firewall unusable.
- After upgrading Panorama, commit and push the configuration to the firewalls you are planning to upgrade.The PAN-OS 9.1 release introduces universally unique identifiers (UUIDs) for policy rules. If you manage firewall policy from Panorama, these UUIDs are generated on Panorama and therefore must be pushed from Panorama. If you do not push the configuration from Panorama prior to upgrading the firewalls, the firewall upgrade will not succeed because it will not have the UUIDs.
- Save a backup of the current configuration file on each managed firewall you plan to upgrade.Although the firewall automatically creates a configuration backup, it is a best practice to create and externally store a backup before you upgrade.
- From the Panorama web interface, selectand clickPanoramaSetupOperationsExport Panorama and devices config bundleto generate and export the latest configuration backup of Panorama and of each managed appliance.
- Save the exported file to a location external to the firewall. You can use this backup to restore the configuration if you have problems with the upgrade.
- Update the content release version on the firewalls you plan to upgrade.Refer to the Release Notes for the minimum content release version required for PAN-OS 9.1. Make sure to follow the Best Practices for Application and Threat Updates when deploying content updates to Panorama and managed firewalls.
- SelectandPanoramaDevice DeploymentDynamic UpdatesCheck Nowfor the latest updates. If an update is available, the Action column displays aDownloadlink.
- If not already installed,Downloadthe latest content release version.
- ClickInstall, select the firewalls on which you want to install the update, and clickOK. If you are upgrading HA firewalls, you must update content on both peers.By default, you can upload a maximum of two software or content updates of each type to a Panorama appliance and if you download a third update of the same type, Panorama will delete the update for the earliest version of that type. If you need to upload more than two software updates or content updates of a single type, use thesetmax-num-images count <number>CLI command to increase the maximum.
- (HA firewall upgrades only)If you will be upgrading firewalls that are part of an HA pair, disable preemption. You need only disable this setting on one firewall in each HA pair.
- Selectand edit theDeviceHigh AvailabilityElection Settings.
- If enabled, disable (clear) thePreemptivesetting and clickOK.
- Commityour change. Make sure the commit is successful before you proceed with the upgrade.
- You cannot skip installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 9.1.0. Review the known issues and changes to default behavior in the Release Notes and upgrade/downgrade considerations in the New Features Guide for each release through which you pass as part of your upgrade path.If upgrading more than one firewall, streamline the process by determining upgrade paths for all firewalls before you start downloading images.
- Download the target PAN-OS 9.1 release image.
- SelectandPanoramaDevice DeploymentSoftwareCheck Nowfor the latest release versions.
- Downloadthe firewall-specific file (or files) for the release version to which you are upgrading. You must download a separate installation file for each firewall model (or firewall series) that you intend to upgrade.For example, to upgrade your PA-220, PA-820, and VM-300 firewalls to PAN-OS 9.1.0, download thePanOS_220-9.1.0,PanOS_vm-9.1.0, andPanOS_800-9.1.0images. After you successfully download an image, the Action column changes toInstallfor that image.
- Install the PAN-OS 9.1 software update on the firewalls.
- ClickInstallin the Action column that corresponds to the firewall models you want to upgrade. For example, if you want to upgrade your PA-820 firewalls, clickInstallin the row that corresponds to PanOS_800-9.1.0.
- In the Deploy Software file dialog, select all firewalls that you want to upgrade. To reduce downtime, select only one peer in each HA pair. For active/passive pairs, select the passive peer; for active/active pairs, select the active-secondary peer.
- (HA firewall upgrades only)Make sureGroup HA Peersis not selected.
- SelectReboot device after install.
- To begin the upgrade, clickOK.
- After the installation completes successfully, reboot using one of the following methods:
- If you are prompted to reboot, clickYes.
- If you are not prompted to reboot, selectandDeviceSetupOperationsReboot Device.
- After the firewalls finish rebooting, selectand verify the Software Version is 9.1.0 for the firewalls you upgraded. Also verify that the HA status of any passive firewalls you upgraded is still passive.PanoramaManaged Devices
- (HA firewall upgrades only)Upgrade the second HA peer in each HA pair.
- (Active/passive upgrades only)Suspend the active device in each active/passive pair you are upgrading.
- Switch context to the active firewall.
- In the High Availability widget on theDashboard, verify thatLocalfirewall state isActiveand thePeerisPassive).
- Select.DeviceHigh AvailabilityOperational CommandsSuspend local device
- Go back to the High Availability widget on theDashboardand verify thatLocalchanged toPassiveandPeerchanged toActive.
- Go back to the Panorama context and select.PanoramaDevice DeploymentSoftware
- ClickInstallin the Action column that corresponds to the firewall models of the HA pairs you are upgrading.
- In the Deploy Software file dialog, select all firewalls that you want to upgrade. This time, select only the peers of the HA firewalls you just upgraded.
- Make sureGroup HA Peersis not selected.
- SelectReboot device after install.
- To begin the upgrade, clickOK.
- After the installation completes successfully, reboot using one of the following methods:
- If you are prompted to reboot, clickYes.
- If you are not prompted to reboot, selectandDeviceSetupOperationsReboot Device.
- (Active/passive upgrades only)From the CLI of the peer you just upgraded, run the following command to make the firewall functional again:request high-availability state functional
- Verify the software and content release version running on each managed firewall.
- On Panorama, select.PanoramaManaged Devices
- Locate the firewalls and review the content and software versions in the table.For HA firewalls, you can also verify that the HA Status of each peer is as expected.If your HA firewalls have local policy rules configured, upon upgrade to PAN-OS 9.1, each peer independently assigns UUIDs for each rule. Because of this, the peers will show as out of sync until you sync the configuration ().DashboardWidgetsSystemHigh AvailabilitySync to peer
- (HA firewall upgrades only)If you disabled preemption on one of your HA firewalls before you upgraded, then edit theElection Settings() and re-enable theDeviceHigh AvailabilityPreemptivesetting for that firewall and thenCommitthe change.
Most Popular
Recommended For You
Recommended Videos
Recommended videos not found.