Panorama Administrator's Guide
    : Downgrade from Panorama 10.0
    Focus
    Download PDF
    Focus
    1. Home
    2. Panorama
    3. Panorama Administrator's Guide
    4. Troubleshooting
    5. Downgrade from Panorama 10.0
    Download PDF

    Panorama Administrator's Guide

    Downgrade from Panorama 10.0

    Table of Contents
    End-of-Life (EoL)

    Downgrade from Panorama 10.0

    Procedure on how to downgrade from Panorama 10.0 to Panorama 9.1.
    PAN-OS® 10.0 introduces the ability to configure local and Panorama administrators for Dedicated Log Collectors and WildFire appliances, the ability to for logs over Ethernet interfaces, automated dynamic updates for air-grapped Panorama™ management servers, the ability to perform actions on filtered rules in the Policy Optimizer, and additional 60 and 90 day filters for monitoring, ACC, on-demand reports. However, these features are not compatible with Panorama running PAN-OS 9.1 or earlier release. Use the following workflow to downgrade firewalls before you downgrade Log Collectors and Panorama running a Panorama 10.0 release to an earlier feature release. This procedure works both for Panorama when managing a local Log Collector and for Panorama when managing one or more Dedicated Log Collectors.
    After a successful downgrade to PAN-OS 9.1, querying threat logs using a
    name-of-threatid
     return no results for up to 24 hours. After which, queries using the
    name-of-threatid
     filter start to return results for logs generated in PAN-OS 9.1 and earlier releases. However, you cannot query logs using this filter for logs generated in PAN-OS 10.0. No action is required on your part.
    Review the Palo Alto Networks Compatibility Matrix to confirm that the firewalls and appliances you intend to downgrade are compatible with the PAN-OS release to which you intend to downgrade. For the firewalls and appliances that you can downgrade, you should also review the Upgrade/Downgrade Considerations to ensure that you account for all features and configuration settings that will be different or unavailable after you downgrade.
    1. Save a backup of the configuration files for Panorama and managed devices.
      1. Export Panorama and device configuration snapshot
         (
        Panorama
        Setup
        Operations
        ).
      2. Save the exported .tgz file to a location external to Panorama, Log Collectors, and firewalls. You can use this backup to restore the configuration if you experience problems that cause you to start over.
    2. If you have configued authentication for a Dedicated Log Collector and removed the
      admin
       administrator, configure and push a new
      admin
       user to your Dedicated Log Collectors.
      Dedicated Log Collectors must have the
      admin
       user configured in order to downgrade to PAN-OS 9.1 and earlier releases.
    3. Downgrade each firewall running a PAN-OS 10.0 release.
      If downgrading more than one firewall, streamline the process by having each firewall-specific PAN-OS 9.1 image downloaded to Panorama before you start downgrading. For example, to downgrade your PA-220 firewall to PAN-OS 9.1.0, download the
      PanOS_220-9.1.0
       or
      PanOS_3000-9.1.0
       images.
      Panorama requires that all firewalls are running the same or an earlier PAN-OS release. So before you downgrade Panorama, use and repeat the appropriate tasks below according to your environment to downgrade all managed firewalls as needed:
      1. Check Now
         for available images (
        Panorama
        Device Deployment
        Software
        ).
      2. Locate the PAN-OS 9.1 image for each model or series of firewalls you intend to downgrade. If the image is not already downloaded, then
        Download
         it.
      Non-HA Firewall
      Install
       (Action column) the appropriate PAN-OS 9.1 version, select all the firewalls you intend to downgrade, select
      Reboot device after install
      , and click
      OK
      .
      Active/Active HA Firewalls
      1. Click
        Install
        , disable (clear)
        Group HA Peers
        , select either of the HA peers, select
        Reboot device after install
        , and click
        OK
        . Wait for the firewall to finish rebooting before you proceed.
      2. Click
        Install
        , disable (clear)
        Group HA Peers
        , select the HA peer that you didn’t update in the previous step, select
        Reboot device after install
        , and click
        OK
        .
      Active/Passive HA Firewalls
      In this example, the active firewall is named fw1 and the passive firewall is named fw2:
      1. Install
         (Action column) the appropriate update, disable (clear)
        Group HA Peers
        , select fw2, select
        Reboot device after install
        , and click
        OK
        .
      2. After fw2 finishes rebooting, verify fw1 (
        Dashboard
        High Availability
         widget) is still the active peer and that fw2 is still the passive peer (the Local firewall state is
        active
         and the Peer—fw2—is
        passive
        ).
      3. Access fw1 and
        Suspend local device
         (
        Device
        High Availability
        Operational Commands
        ).
      4. Access fw2 (
        Dashboard
        High Availability
        ) and verify that the Local firewall state is
        active
         and the Peer firewall—fw1—is
        suspended
        .
      5. Access Panorama, select
        Panorama
        Device Deployment
        Software
        ,
        Install
         (Action column) the appropriate update, disable (clear)
        Group HA Peers
        , select fw1, select
        Reboot device after install
        , and click
        OK
        . Wait for fw1 to finish rebooting before you proceed.
      6. Access fw1 (
        Dashboard
        High Availability
         widget) and verify that the Local firewall state is
        passive
         and the Peer—fw2—is
        active
        .
        If you enabled preemption in the Election settings (
        Device
        High Availability
        General
        ), then fw1 will be reinstated as the active peer after reboot.
    4. Downgrade each Log Collector running Panorama 10.0.
      1. Check Now
         for available images (
        Panorama
        Device Deployment
        Software
        ).
      2. Locate the Panorama 9.1 image. If the image is not already downloaded, then
        Download
         it (Action column).
      3. After the download is complete,
        Install
         the image on each Log Collector running Panorama 10.0. Select
        Reboot device after install
         to automatically reboot the device when the upgrade is complete.
    5. Downgrade Panorama.
      1. Select
        Panorama
        Software
         and
        Check Now
         for available images.
      2. Locate the Panorama 9.1 image. If the image is not already downloaded, then
        Download
         it.
      3. After the download is complete,
        Install
         the image on Panorama.
      4. Reboot Panorama as follows:
        • If you are prompted to reboot, click
          Yes
          . If you see a
          CMS Login
           prompt, press Enter without typing the username or password. When the Panorama login prompt appears, enter the username and password you set during initial configuration.
        • If you are not prompted to reboot, select
          Panorama
          Setup
          Operations
           and click
          Reboot Panorama
           (Device Operations).

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.