Install Updates for Panorama in an HA Configuration

Upgrade the Panorama software on the Secondary_B (passive) peer.
Perform one of the following tasks on the Secondary_B peer:
Install Updates for Panorama with an Internet Connection
Install Updates for Panorama When Not Internet-Connected
After the upgrade, this Panorama transitions to a non-functional state because the peers are no longer running the same software release.
Suspend the Primary_A peer to force a failover.
On the Primary_A peer:
In the
Operational Commands
section (
Panorama
High Availability
),
Suspend local Panorama
.
Verify that state is
suspended
(displayed on bottom-right corner of the web interface).
The resulting failover should cause the Secondary_B peer to transition to
active
state.
Upgrade the Panorama software on the Primary_A (currently passive) peer.
Perform one of the following tasks on the Primary_A peer:
Install Updates for Panorama with an Internet Connection
Install Updates for Panorama When Not Internet-Connected
After you reboot, the Primary_A peer is initially still in the passive state. Then, if preemption is enabled (default), the Primary_A peer automatically transitions to the active state and the Secondary_B peer reverts to the passive state.
If you disabled preemption, manually Restore the Primary Panorama to the Active State.
Verify that both peers are now running any newly installed content release versions and the newly installed Panorama release.
On the
Dashboard
of each Panorama peer, check the Panorama Software Version and Application Version and confirm that they are the same on both peers and that the running configuration is synchronized.
Migrate Panorama Logs to the New Log Format.
When you upgrade to a Panorama 8.0 (or later) release, Panorama Log Collectors use a new log storage format. Because Panorama can no longer generate reports or ACC data from logs in the pre-8.0-release log format, you must migrate the existing logs as soon as you upgrade Panorama and its Log Collectors from a PAN-OS 7.1 or earlier release to a PAN-OS 8.0 or later release. Log migration is a one-time task; after you migrate the logs on the Log Collector as part an upgrade to a PAN-OS 8.0 or later release, you do not need to migrate them again.