Install Updates for Panorama in an HA Configuration
To ensure a seamless failover when you update the
Panorama software in a high availability (HA) configuration, the
active and passive Panorama peers must be running the same Panorama
release with the same Applications database version. The following
example describes how to upgrade an HA pair (active peer is Primary_A
and passive peer is Secondary_B).
8.0 requires the following minimum content release versions:
and Threats content release version 655
Antivirus content release version 2137
Upgrade the Panorama software on the Secondary_B
Perform one of the following tasks on the Secondary_B peer:
you reboot, the Primary_A peer is initially still in the passive
state. Then, if preemption is enabled (default), the Primary_A peer
automatically transitions to the active state and the Secondary_B
peer reverts to the passive state.
When you upgrade to a Panorama 8.0 (or later) release, Panorama
Log Collectors use a new log storage format. Because Panorama can
no longer generate reports or ACC data from logs in the pre-8.0-release log
format, you must migrate the existing logs as soon as you upgrade Panorama
and its Log Collectors from a PAN-OS 7.1 or earlier release to a PAN-OS
8.0 or later release. Log migration is a one-time task; after you
migrate the logs on the Log Collector as part an upgrade to a PAN-OS
8.0 or later release, you do not need to migrate them again.