Panorama Administrator's Guide
    : Install Updates for Panorama When Not Internet-Connected
    Focus
    Download PDF
    Focus
    1. Home
    2. Panorama
    3. Panorama Administrator's Guide
    4. Set Up Panorama
    5. Install Content and Software Updates for Panorama
    6. Install Updates for Panorama When Not Internet-Connected
    Download PDF

    Panorama Administrator's Guide

    Install Updates for Panorama When Not Internet-Connected

    Table of Contents
    End-of-Life (EoL)

    Install Updates for Panorama When Not Internet-Connected

    If Panorama™ does not have a direct connection to the internet, perform the following steps to install Panorama software and content updates as needed. If Panorama is deployed in a high availability (HA) configuration, you must upgrade each peer (see Install Updates for Panorama in an HA Configuration).
    Upgrading the software on the Panorama virtual appliance does not change the system mode; switching to Panorama mode or Management Only mode is a manual task that requires additional settings as described when you Set Up the Panorama Virtual Appliance with Local Log Collector.
    If you are upgrading from PAN-OS 8.1, PAN-OS® 9.0 introduced a new log data format for local and Dedicated Log Collectors. On your upgrade path to PAN-OS 10.0, existing log data is automatically migrated to the new format when you upgrade to PAN-OS 9.0. During reformatting, log data is not visible in the ACC or Monitor tabs. Additionally, new log data is not forwarded to Log Collectors until reformatting is complete. While the reformatting takes place, new logs are written to the firewall system disk and after the procedure is successfully completed, the new logs are forwarded to the appropriate Log Collector.
    You must upgrade all Log Collectors in a collector group at the same time to avoid losing log data loss. No log forwarding or log collection occurs if the Log Collectors in a collector group are not all running the same PAN-OS version. Additionally, the log data for the Log Collectors in the collector group is not visible in the ACC or Monitor tabs until all Log Collectors are running the same PAN-OS version. For example, if you have three Log Collectors in a collector group and you upgrade two of the Log Collectors, then no logs are forwarded to any Log Collectors in the collector group.
    Before you upgrade Panorama, refer to the Release Notes for the minimum content release version required for PAN-OS® 10.0.
    1. Verify that the updates you plan to install are appropriate for your Panorama deployment.
      Palo Alto Networks highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version.
    2. Determine the Upgrade Path to PAN-OS 10.0.
      You cannot skip the installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 10.0. Review the known issues and changes to default behavior in the Release Notes and upgrade/downgrade considerations in the New Features Guide for each release through which you pass as part of your upgrade path.
    3. Save a backup of the current Panorama configuration file that you can use to restore the configuration if you have problems with the upgrade.
      Although Panorama automatically creates a backup of the configuration, best practice is to create and externally store a backup before you upgrade.
      1. Log in to the Panorama Web Interface.
      2. Save named Panorama configuration snapshot (PanoramaSetupOperations), enter a Name for the configuration, and click OK.
      3. Export named Panorama configuration snapshot, select the Name of the configuration you just saved, click OK, and save the exported file to a location that is external to Panorama.
    4. Download the latest content updates to a host that can connect and upload content to Panorama either over SCP or HTTPS.
      If you do not need to install content updates at this time, then skip ahead to 5.
      1. Use a host that has internet access to log in to the Palo Alto Networks Customer Support website.
      2. Download content updates as needed:
        1. Click UpdatesDynamic Updates in the Resources section.
        2. Download the appropriate content updates and save the files to the host. Perform this step for each content type you need to update.
    5. Install the latest content updates.
      You must install content updates before software updates and you must Upgrade Firewalls first and then Upgrade Log Collectors before you install them on the Panorama management server.
      Install the Applications or Applications and Threats update first, and then install any other updates (Antivirus, WildFire®, and URL Filtering), one at a time, and in any sequence.
      Regardless whether your subscription includes both Applications and Threats content, Panorama installs and needs only the Applications content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
      Log in to the Panorama web interface and perform the following steps for each content type:
      1. Select PanoramaDynamic Updates
      2. Click Upload, select the content Type, Browse to the location on the host to which you downloaded the update, select the update, and click OK.
      3. Install From File, select the Package Type, and click OK.
    6. Upgrade Panorama to the PAN-OS releases along your upgrade path to PAN-OS 10.0.
      1. Install Updates for Panorama When Not Internet Connected to PAN-OS 8.1.
      2. Install Updates for Panorama When Not Internet Connected to PAN-OS 9.0.
        PAN-OS 9.0 introduced a new log format. If a local Log Collector is configured, logs are automatically migrated to the new format after you successfully upgrade Panorama to PAN-OS 9.0.
        Do not continue on your upgrade path until you verify the automatic log migration completed successfully.
      3. Install Updates for Panorama When Not Internet Connected to PAN-OS 9.1.
    7. Download the software updates to a host that can connect and upload content to Panorama either over SCP or HTTPS.
      1. Use a host with internet access to log in to the Palo Alto Networks Customer Support web site.
      2. Download software updates:
        1. On the main page of Palo Alto Networks Customer Support website, click UpdatesSoftware Updates.
        2. For the first (or next) Panorama release in your upgrade path, identify the model-specific file. For example, to upgrade an M-Series appliance to Panorama 10.0.0, download the Panorama_m-10.0.0 image; to upgrade a Panorama virtual appliance to Panorama 10.0.0, download the Panorama_pc-10.0.0 image.
          You can quickly locate Panorama images by selecting Panorama M Images (M-Series appliances) or Panorama Updates (virtual appliances) from the Filter By drop-down.
          (Panorama in Legacy mode only) Download both the PAN-OS 10.0.0 image and the PAN-OS 10.0.8 or later release image.
          This is required to preserve all logs stored on the NFS storage partition. Some logs stored on the NFS storage partition of a Panorama in Legacy mode are deleted if you install PAN-OS 10.0.7 or earlier PAN-OS 10.0 release.
        3. Click the filename and save the file to the host.
    8. Upgrade Panorama to PAN-OS 10.0.
      1. Log in to the Panorama Web Interface.
      2. Select PanoramaSoftware and Upload the PAN-OS 10.0 image you downloaded in the previous step.
        (Panorama in Legacy mode only) Upload both the PAN-OS 10.0.0 image and the PAN-OS 10.0.8 or later release image.
      3. Browse to the location on the host to which you downloaded the update, select the update, Sync To Peer if Panorama is in an HA configuration (to push the software image to the secondary peer), and click OK.
      4. Install the software image and reboot.
        For an HA configuration, Install Updates for Panorama in an HA Configuration; otherwise:
        1. Install the downloaded image.
          (Panorama in Legacy mode only) Install the PAN-OS 10.0.8 or later release image only.
        2. After you successfully complete the installation, reboot using one of the following methods:
          • If prompted to reboot, click Yes. If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the username and password you specified during initial configuration.
          • If you are not prompted to reboot, Reboot Panorama from the Device Operations section (PanoramaSetupOperations).
    9. (If local Log Collector is in a Collector Group) Upgrade the remaining Log Collectors in the Collector Group.

    © 2024 Palo Alto Networks, Inc. All rights reserved.