For a list of software and content updates you can install on Log Collectors, see
Deploy an Update to Log Collectors when Panorama is Internet-connected
Before you upgrade Log Collectors, ensure that you are running the appropriate Panorama software release on the Panorama management server.
Palo Alto Networks highly recommends that Panorama and Log Collectors run the same Panorama software release and that Panorama, Log Collectors, and all managed firewalls run the same content release version.
Panorama must be running the same (or later) software release as Log Collectors but must have the same or an earlier content release version:
Software release version
—If your Panorama management server is not already running the same or a later software release than the release to which you intend to update Log Collectors, then you must install the same or a later Panorama release on Panorama (see
Install Content and Software Updates for Panorama) before you update any Log Collectors.
Content release version
—For content release versions, you should ensure that all Log Collectors are running the latest content release version or, at minimum, are running a later version than is running on Panorama; if not, then first update managed firewalls (using Panorama)
and then update Log Collectors before you update the content release version on the Panorama management server.
To check software and content versions:
Panorama management server
—To determine what software and content versions are running on the Panorama management server, log in to the Panorama web interface and go to General Information settings (
—To determine what software and content versions are running on Log Collectors, log in to the CLI of each Log Collector and run the
show system info
Install the latest content updates.
Refer to the Release Notes
for the minimum content release versions required for a Panorama software release.
Check Now (
Panorama > Device Deployment > Dynamic Updates) for the latest updates. If an update is available, the Action column displays a
If not already installed,
the appropriate content updates. After a successful download, the link in the Action column changes from Download to Install.
Install the content update (Applications or Applications and Threats update before any others):
Install, select the Log Collectors, and click
Regardless whether your subscription includes both Applications and Threats content, Panorama installs and needs only the Applications content. For details, see
Panorama, Log Collector, and Firewall Version Compatibility.
3 for any other updates (Antivirus, WildFire, or URL Filtering) as needed, one at a time, and in any sequence.
Determine the software upgrade path for each Log Collector that you intend to update.
You cannot skip installation of any major release versions in the path to your target Panorama release. For example, if you intend to upgrade from Panorama 6.0.13 to Panorama 7.1.3, you must:
Download and install Panorama 6.1.0.
Download and install Panorama 7.0.1 and reboot (7.0.1 is the base image for the 7.0 release; not 7.0.0).
Download Panorama 7.1.0.
Optionally, install this base image and reboot before you install the target maintenance release.
Download and install Panorama 7.1.3 and reboot.
Check which Software Version is running on each Log Collector you intend to upgrade (
Panorama > Managed Collectors) and take note of each release you need to download in your path to Panorama 7.1.
If upgrading more than one Log Collector, streamline the process by determining the upgrade paths for all Log Collectors you intend to upgrade before you start downloading images.
We highly recommend that you review the known issues and changes to default behavior in the Release Notes
and upgrade/downgrade considerations in the New Features Guide
for each release through which you pass as part of your upgrade path.
For all Log Collectors you intend to update, use the upgrade path(s) identified in
Step 3 to upgrade Log Collectors to your target Panorama release.
On Panorama, Check Now (
Panorama > Device Deployment > Software) for the latest updates. If an update is available, the Action column displays a
For each release in your upgrade path,
the model-specific file for the release version to which you are upgrading. For example, to upgrade an M-Series appliance to Panorama 7.0.1, download the
After a successful download, the Action column changes from
to Install for that image.
for the first (or next) version in your upgrade path and select the appropriate Log Collectors.
Select one of the following depending on the version you are installing within your upgrade path (
Upload only to device (do not install)
Reboot device after install
As a best practice, when upgrading to a Panorama 7.1 maintenance release (Panorama 7.1.1 or a later release), install the Panorama 7.1.0 base image and reboot the appliance before you download and install the maintenance release.
to start the installation (or upload).
6 until Log Collectors are running the desired release.
Verify the software and content update versions that are installed on the Log Collector.
Log in to the Log Collector CLI and enter the
show system info
operational command. The output will resemble the following:
app-release-date: 2016/01/29 15:46:03
av-release-date: 2016/01/21 14:31:27
threat-release-date: 2016/01/29 15:46:03