Install Updates for Panorama with an Internet Connection
If Panorama™ has a direct connection to the internet, perform the following steps to install Panorama software and content updates as needed. If Panorama is running in a high availability (HA) configuration, upgrade the Panorama software on each peer (see Install Updates for Panorama in an HA Configuration).
Upgrading the software on the Panorama virtual appliance does not change the system mode; switching to Panorama mode or Legacy mode is a manual task that requires additional settings as described when you Set Up the Panorama Virtual Appliance with Local Log Collector.
- Verify that the updates you plan to install are
appropriate for your Panorama deployment.
- For a Panorama virtual appliance that runs on an ESXi server, ensure that the server meets the Setup Prerequisites for the Panorama Virtual Appliance.
- Save a backup of the current Panorama configuration file
that you can use to restore the configuration if you have problems
with the upgrade.Although Panorama automatically creates a backup of the configuration, best practice is to create and externally store a backup before you upgrade.
- Save named Panorama configuration snapshot (PanoramaSetupOperations), enter a Name for the configuration, and click OK.
- Export named Panorama configuration snapshot, select the Name of the configuration you just saved, click OK, and save the exported file to a location that is external to Panorama.
- (As needed) Install content updates.If Panorama is not running the minimum content versions required for the Panorama release to which you intend to upgrade, you must update content versions to the minimum (or later) versions before you install the software updates. Refer to Release Notes for minimum content release version for a Panorama release.Palo Alto Networks® highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version. Additionally, we recommend that you schedule automatic, recurring updates so that you are always running the latest content versions (Step 7).
- Check Now (PanoramaDynamic Updates) for
the latest updates. If the value in the Action column is Download,
an update is available.Ensure that Panorama is running the same but not a later content release version than is running on managed firewalls and Log Collectors.
- (As needed) Before you update the content
release version on Panorama, be sure to upgrade managed firewalls and then Log
Collectors (see Upgrade
Log Collectors When Panorama Is Internet-Connected) to the
same (or a later) content release version.If you do not need to install content updates at this time, then skip ahead to Step 4.
- Install remaining content updates, as needed. When
installed, the Currently Installed column displays a check mark.
- Download and Install the Applications or Applications and Threats update. Regardless of your subscription, Panorama installs and needs only the Applications content update, not the Threats content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
- Download and Install other updates (Antivirus, WildFire®, or URL Filtering) as needed, one at a time, and in any sequence.
- Check Now (PanoramaDynamic Updates) for the latest updates. If the value in the Action column is Download, an update is available.
the software upgrade path. Refer to the New Features Guide for the upgrade path
to PAN-OS® 8.0.Check which version has a check mark in the Currently Installed column (PanoramaSoftware) and proceed as follows.
- Use the upgrade path identified
in Step 4 to
upgrade to a Panorama 7.1 release.Repeat the following procedure until the appliance is running a Panorama 7.1 release—do not skip installation of any major release version in the path to your target Panorama 8.0 release.
- Check Now (PanoramaSoftware) for the latest updates. If an update is available, the Action column displays a Download link.
- For each release in your upgrade path, Download the
model-specific file for the release version to which you are upgrading.
For example, to upgrade an M-Series appliance to Panorama 7.1.0,
download the Panorama_m-7.1.0 image; to upgrade
a Panorama virtual appliance to Panorama 7.1.0, download the Panorama_pc-7.1.0 image.
After a successful download, the Action column changes from Download to Install for
that image.By default, you can download a maximum of two software or content updates of each type on a Panorama appliance; if you download a third update of the same type, Panorama will delete the update for the earliest version of that type. If you need to upload more than two software updates or content updates of a single type, use the set max-num-images count <number> CLI command to increase the maximum.
- Install the software update.
- If prompted to reboot, click Yes. If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the username and password you specified during initial configuration.
- If you are not prompted to reboot, Reboot Panorama from the Device Operations section (PanoramaSetupOperations).
- Repeat these for each release in your upgrade path until you are running Panorama 7.1.
- Check Now (PanoramaSoftware)
for the latest updates. If an update is available, the Action column
displays Download.If you are upgrading to Panorama 8.0.3 or a later release, first download the Panorama 8.0.2 base image.
- Locate and Download the model-specific file for the release version to which you are upgrading. For example, to upgrade an M-Series appliance to Panorama 8.0.2, download the Panorama_m-8.0.2 image; to upgrade a Panorama virtual appliance to Panorama 8.0.2, download the Panorama_pc-8.0.2 image. After a successful download, the Action column changes from Download to Install for the downloaded image.
- (Required for the target release;
also required for the base image—Panorama 8.0.2—if you manually
download or upload the base image when upgrading to Panorama 8.0.3
or a later release) Install the downloaded image and then reboot.
- Install the image.As a best practice, when you upgrade to Panorama 8.0.3 or a later release, install the Panorama 8.0.2 base image and reboot the appliance before you download and install the maintenance release even if you downloaded the base image directly from the Software Updates server.
- After the installation completes successfully, reboot using one of the following methods:
- (Required only if upgrading to PAN-OS 8.0.3 or a later release) After completing the above steps for the PAN-OS 8.0.2 base image, repeat steps a through c to upgrade to the target maintenance release.
- Check Now (PanoramaSoftware) for the latest updates. If an update is available, the Action column displays Download.
- (Best Practice) Schedule
recurring, automatic content updates.Panorama does not synchronize content update schedules across HA peers. You must perform this task on both the active and passive Panorama.In the header row for each update type (PanoramaDynamic Updates), the Schedule is initially set to None. Perform the following steps for each update type.
- Click None and select the update frequency (Recurrence). The frequency options depend on the update type.
- Select the schedule action:
- Download And Install (Best Practice)—Panorama automatically installs updates after downloading them.
- Download Only—You must manually install updates after Panorama downloads them.
- Based on the best practices for the security posture of your organization, configure a delay (Threshold) after an update becomes available before Panorama downloads the update.
- Click OK to save your changes.
- Select CommitCommit to Panorama and Commit your changes.
Panorama Logs to the New Log Format.When you upgrade to a Panorama 8.0 or later release, Panorama Log Collectors use a new log storage format. Because Panorama can no longer generate reports or ACC data from logs in the pre-8.0-release log format, you must migrate the existing logs as soon as you upgrade Panorama and its Log Collectors from a PAN-OS 7.1 or earlier release to a PAN-OS 8.0 or later release. Log migration is a one-time task; after you migrate the logs on the Log Collector as part an upgrade to a PAN-OS 8.0 or later release, you do not need to migrate them again.
Install Updates for Panorama When Not Internet-Connected
Install Updates for Panorama When Not Internet-Connected If Panorama™ does not have a direct connection to the internet, perform the following steps to install Panorama ...
Deploy an Update to Log Collectors when Panorama is Internet-connected
Upgrade Log Collector software to PAN-OS® 8.0 and install content updates using Panorama™ when Panorama is connected to the internet. ...
Deploy an Update to Log Collectors when Panorama is not Internet-connected
Upgrade Log Collector software to PAN-OS® 8.0 and install content updates using Panorama™ when Panorama is not connected to the internet. ...
Deploy an Update to Firewalls when Panorama is not Internet-connected
Upgrade firewall software to PAN-OS® 8.0 and install content updates using Panorama™ when Panorama is not connected to the internet. ...
Install Updates for Panorama in an HA Configuration
Install Updates for Panorama in an HA Configuration To ensure a seamless failover when you update the Panorama software in a high availability (HA) configuration, ...
Upgrade a Firewall to PAN-OS 8.0
Upgrade a Standalone Firewall to PAN-OS 8.0 Review the PAN-OS 8.0 Release Notes and then use the following procedure to upgrade a firewall not in ...
Upgrade Firewalls Using Panorama
Upgrade Firewalls Using Panorama Review the PAN-OS 8.0 Release Notes and then use the following procedure to upgrade firewalls that you manage with Panorama. This ...
Deploy Updates to Firewalls, Log Collectors, and WildFire Appliances Using Panorama
Use Panorama™ to test software and content updates on a subset of firewalls and Dedicated Log Collectors before you deploy to all your firewalls and ...
Determine the Upgrade Path to PAN-OS 8.0
Determine the Upgrade Path to PAN-OS 8.0 When you upgrade from one PAN-OS feature release version to a later feature release, you cannot skip the ...