A valid support subscription enables access to the Panorama software image and release notes. To take advantage of the latest fixes and security enhancements, it is a good idea to upgrade to the latest software update or to the update version that your reseller or a Palo Alto Networks Systems Engineer recommends. The procedure to install software and content updates depends on whether Panorama has a direct connection to the internet and whether it has a high availability (HA) configuration.
Palo Alto Networks highly recommends running the same Panorama release on both the Panorama management server and the Dedicated Log Collectors. Panorama can manage firewalls that are running the same or an earlier PAN-OS release with the caveat that Panorama 6.1 and later versions cannot push configurations to firewalls running PAN-OS 6.0.0 through 6.0.3.
Regardless whether your subscriptions include the Applications database or Applications and Threats database, Panorama installs only the Applications database. Panorama and Dedicated Log Collectors do not enforce policy rules so they do not require the threat signatures in the Threats database. The Applications database contains threat metadata (such as threat IDs and names) that you use on Panorama and Dedicated Log Collectors when defining policy rules to push to managed firewalls and when interpreting threat information in logs and reports. However, firewalls do require the full Applications and Threats database to match the identifiers recorded in logs with the corresponding threat, URL, or application names. Refer to the
Release Notes
for the minimum content release version required for a Panorama release.
To ensure a seamless failover when you update the Panorama software in a high availability (HA) configuration, the active and passive Panorama peers must be running the same Panorama release with the same Applications database version. The following example describes how to upgrade an HA pair (active peer is Primary_A and passive peer is Secondary_B).
|
|
|
|
|
|
|
|
|
|
|
|
If Panorama has a direct connection to the internet, perform the following steps to install Panorama software updates. If Panorama is deployed in a high availability (HA) configuration, you must upgrade the Panorama software on each peer as described when you
Install Updates for Panorama in an HA Configuration .
|
|
|
|
|
Although Panorama automatically creates a backup configuration, best practice is to create and externally store a backup before you upgrade. |
|
If Panorama is not running the minimum content versions required for the Panorama release to which you intend to upgrade, you must update content versions to the minimum (or later) versions before you install the software updates. Refer to the 
Palo Alto Networks highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version. Additionally, we recommend that you schedule automatic, recurring updates so that you are always running the latest content versions ( |
Ensure that Panorama is running the same but not a later content release version than is running on managed firewalls and Log Collectors. |
|
|
We highly recommend that you review the known issues and changes to default behavior in the |
|
|
By default, you can download a maximum of two software or content updates of each type on a Panorama appliance and if you download a third update of the same type, Panorama will delete the update for the earliest version of that type. If you need to upload more than two software updates or content updates of a single type, use the |
|
|
If you are upgrading to a Panorama 7.1 maintenance release (a release other than the Panorama 7.1.0 base image), first download the Panorama 7.1.0 release.
As a best practice, when upgrading to a Panorama 7.1 maintenance release (Panorama 7.1.1 or later release), install the Panorama 7.1.0 base image and reboot the appliance before you download and install the maintenance release. |
Panorama does not synchronize content update schedules across HA peers. You must perform this task on both the active and passive Panorama. |
|
|
|
|
If Panorama does not have a direct connection to the internet, perform the following steps to install content and software updates. If Panorama is deployed in a high availability (HA) configuration, you must upgrade each peer as described when you
Install Updates for Panorama in an HA Configuration .
|
|
|
|
|
Although Panorama automatically creates a backup of the configuration, best practice is to create and externally store a backup before you upgrade. |
|
You must install content updates before software updates.
Palo Alto Networks highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version. |
Ensure that Panorama is running the same but not a later content release version than is running on managed firewalls and Log Collectors. |
|
|
If Panorama is not running the minimum content versions required for the Panorama release to which you intend to upgrade, refer to the 
Palo Alto Networks highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version. |
You must install content updates before software updates and you must |
Regardless whether your subscription includes both Applications and Threats content, Panorama installs and needs only the Applications content. For details, see |
|
|
We highly recommend that you review the known issues and changes to default behavior in the |
|
|
You can quickly locate Panorama images by selecting |
|
|
As a best practice, when upgrading to a Panorama 7.1 maintenance release (Panorama 7.1.1 or a later Panorama 7.1 release), install the Panorama 7.1.0 base image and reboot the appliance before you upload and install the maintenance release. |
|
|
|