Install Updates Automatically for Panorama without an Internet Connection

Deploy an SCP server.
Dynamic updates for managed firewalls, Log Collectors, and WildFire appliances downloads from the internet-connected Panorama. The air-gapped Panorama downloads the dynamic updates from the SCP server and then installs the updates on managed firewalls, WildFire appliances, and Log Collectors.
When you create the folder directory for dynamic updates, it is a best practice to create a folder for each type of type of dynamic update. This is the burden of managing a large volume of dynamic updates and reduces the possibility of deleting dynamic updates that should not be deleted from the SCP server.
Deploy the internet-connected Panorama.
This Panorama communicates with the Palo Alto Networks update server and downloads the dynamic updates to the SCP server.
Set up the Panorama management server.
Set Up the M-Series Appliance
Set Up the Panorama Virtual Appliance
Perform the initial Panorama configuration.
Perform Initial Configuration of the M-Series Appliance
Perform Initial Configuration of the Panorama Virtual Appliance
Deploy the Panorama without an internet connection.
This Panorama communicates with the SCP server to download and install dynamic updates on managed firewalls, Log Collectors, and WildFire appliances.
Set up the Panorama management server.
Set Up the M-Series Appliance
Set Up the Panorama Virtual Appliance
Perform the initial Panorama configuration.
Perform Initial Configuration of the M-Series Appliance
Perform Initial Configuration of the Panorama Virtual Appliance
Add your managed firewalls, Log Collectors, and WildFire appliances.
Add a Firewall as a Managed Device
Configure a Managed Collector
Add Standalone WildFire Appliances to Manage with Panorama
Configure the internet-connected Panorama to download dynamic updates to your SCP server.
Log in to the Panorama Web Interface.
Create an SCP server profile.
Select
Panorama
Server Profiles
SCP
and
Add
a new SCP server profile.
Enter a descriptive
Name
for the SCP server profile.
Enter the SCP
Server
IP address.
Enter the
Port
.
Enter the SCP server
User Name
.
Enter the SCP server
Password
and
Confirm Password
.
Click
OK
to save your changes.

Create a dynamic updates schedule to regularly download dynamic updates to the SCP server.
You must create a schedule for each type of dynamic update you intend to automatically download and install on managed firewalls, Log Collectors, and WildFire appliances.
Select

Panorama

Device Deployment

Dynamic Updates

, select

Schedules

, and

Add

a dynamic updates schedule.

Enter a descriptive

Name

for the dynamic updates schedule.

For the

Download Source

, select

Update Server

.

Select the dynamic update

Type

.

Select the

Recurrence

to set the interval at which Panorama checks the Palo Alto Networks update server for new dynamic updates.

To configure a more precise recurrence schedule, enter the number of minutes past the selected recurrence interval. If you have multiple dynamic updates scheduled to download using the same recurrence interval, stagger them to avoid overloading the Panorama and SCP server.

For the

Action

, select

Download And SCP

.

Select the

SCP Profile

you configured in the previous step.

Enter the

SCP Path

for the dynamic updates type.

(

Optional

) Enter the

Threshold

, in hours, for the dynamic updates. Panorama downloads only dynamic updates that are this number of hours old (or older)

Click

OK

to save your changes.


Commit
your changes.
Configure the air-gapped Panorama to download dynamic updates from the SCP server and then install the updates on your managed firewalls, Log Collectors, and WildFire appliances.
Log in to the Panorama Web Interface.
Create an SCP server profile.
Select
Panorama
Server Profiles
SCP
and
Add
a new SCP server profile.
Enter a descriptive
Name
for the SCP server profile.
Enter the SCP
Server
IP address.
Enter the
Port
.
Enter the SCP server
User Name
.
Enter the SCP server
Password
and
Confirm Password
.
Click
OK
to save your changes.

Create a dynamic updates schedule to regularly download and install dynamic updates from the SCP server.
You must create a schedule for each type of dynamic update you intend to automatically download and install on managed firewalls, Log Collectors, and WildFire appliances.
Select

Panorama

Device Deployment

Dynamic Updates

, select

Schedules

, and

Add

a dynamic updates schedule.

Enter a descriptive

Name

for the dynamic updates schedule.

For the

Download Source

, select

SCP

.

Select the

SCP Profile

you configured in the previous step.

Enter the

SCP Path

for the dynamic updates type.

Select the dynamic update

Type

.

Select the

Recurrence

to set the interval at which Panorama checks the Palo Alto Networks update server for new dynamic updates.

To configure a more precise recurrence schedule, enter the number of minutes past the selected recurrence interval. If you have multiple dynamic updates scheduled to download using the same recurrence interval, stagger them to avoid overloading the Panorama and SCP server.

For the

Action

, select

Download

or

Download And Install

.

Only

Download

and

Download and Install

are supported when the

Download Source

is

SCP

.

If you select

Download

, you must manually start the dynamic update install on your managed firewalls.

Select the

Devices

on which to install the dynamic updates.

(

Optional

) Enter the

Threshold

, in hours, for the dynamic updates. Panorama downloads only dynamic updates that are this number of hours old (or older)

Click

OK

to save your changes.


Commit
your changes.