Install Updates for Panorama with an Internet Connection

If Panorama™ has a direct connection to the internet, perform the following steps to install Panorama software and content updates as needed. If Panorama is running in a high availability (HA) configuration, upgrade the Panorama software on each peer (see Install Updates for Panorama in an HA Configuration).
Upgrading the software on the Panorama virtual appliance does not change the system mode; switching to Panorama mode or Management Only mode is a manual task that requires additional settings as described when you Set Up the Panorama Virtual Appliance with Local Log Collector.
Before updating Panorama, refer to the Release Notes. for the minimum content release version required for PAN-OS 8.1.
For Panorama on Azure, additional steps must be taken to successfully upgrade the software version. To upgrade, you need to export the Panorama configuration, upgrade the content and software versions, and import the configuration to the Panorama management server once you successfully upgrade.
  1. Verify that the updates you plan to install are appropriate for your Panorama deployment.
  2. Save a backup of the current Panorama configuration file that you can use to restore the configuration if you have problems with the upgrade.
    Although Panorama automatically creates a backup of the configuration, best practice is to create and externally store a backup before you upgrade.
    1. Save named Panorama configuration snapshot
      (
      Panorama
      Setup
      Operations
      ), enter a
      Name
      for the configuration, and click
      OK
      .
    2. Export named Panorama configuration snapshot
      , select the
      Name
      of the configuration you just saved, click
      OK
      , and save the exported file to a location that is external to Panorama.
  3. (
    As needed
    ) Install content updates.
    If Panorama is not running the minimum content versions required for the Panorama release to which you intend to upgrade, you must update content versions to the minimum (or later) versions before you install the software updates. Refer to Release Notes for minimum content release version for a Panorama release.
    Palo Alto Networks® highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version. Additionally, we recommend that you schedule automatic, recurring updates so that you are always running the latest content versions (refer to (Best Practice) Schedule recurring, automatic content updates.).
    1. Check Now
      (
      Panorama
      Dynamic Updates
      ) for the latest updates. If the value in the Action column is
      Download
      , an update is available.
      Ensure that Panorama is running the same but not a later content release version than is running on managed firewalls and Log Collectors.
    2. (
      As needed
      ) Before you update the content release version on Panorama, be sure to upgrade managed firewalls and then Log Collectors (see Upgrade Log Collectors When Panorama Is Internet-Connected) to the same (or a later) content release version.
      If you do not need to install content updates at this time, then skip ahead to the next step.
    3. Install remaining content updates, as needed. When installed, the Currently Installed column displays a check mark.
      1. Download
        and
        Install
        the Applications or Applications and Threats update. Regardless of your subscription, Panorama installs and needs only the Applications content update, not the Threats content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
      2. Download
        and
        Install
        other updates (Antivirus, WildFire®, or URL Filtering) as needed, one at a time, and in any sequence.
  4. Determine the software upgrade path. Refer to the New Features Guide for the upgrade path to PAN-OS® 8.1.
    Check which version has a check mark in the Currently Installed column (
    Panorama
    Software
    ) and make a list of all versions in your upgrade path that you need to download from the Palo Alto Networks update server so that you can upload each to the appliance as needed when you upgrade.
    We highly recommend that you review the known issues and changes to default behavior in the ReleaseNotes and upgrade/downgrade considerations in the New Features Guide for each release through which you pass as part of your upgrade path.
  5. Use the upgrade path identified in Step 4 to upgrade to the latest Panorama 8.0 maintenance release. If your appliance is already running the latest Panorama 8.0 maintenance release, then skip ahead to Step 6.
    Repeat the following procedure until the appliance is running the latest Panorama 8.0 release—do not skip installation of any feature release version in the path to your target Panorama 8.1 release.
    1. Check Now
      (
      Panorama
      Software
      ) for the latest updates. If an update is available, the Action column displays a
      Download
      link.
    2. For each release in your upgrade path,
      Download
      the model-specific file for the release version to which you are upgrading. For example, to upgrade an M-Series appliance to Panorama 8.0.2, download the
      Panorama_m-8.0.2
      image; to upgrade a Panorama virtual appliance to Panorama 8.0.2, download the
      Panorama_pc-8.0.2
      image. After a successful download, the Action column changes from
      Download
      to
      Install
      for that image.
      By default, you can download a maximum of two software or content updates of each type on a Panorama appliance; if you download a third update of the same type, Panorama will delete the update for the earliest version of that type. If you need to upload more than two software updates or content updates of a single type, use the
      set max-num-images count
      <number>
      CLI command to increase the maximum.
    3. Install
      the software update.
      • If prompted to reboot, click
        Yes
        . If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the username and password you specified during initial configuration.
      • If you are not prompted to reboot,
        Reboot Panorama
        from the Device Operations section (
        Panorama
        Setup
        Operations
        ).
    4. Repeat these for each release in your upgrade path until you are running the latest PAN-OS 8.0 maintenance release.
  6. Install Panorama 8.1.
    1. Check Now
      (
      Panorama
      Software
      ) for the latest updates. If an update is available, the Action column displays
      Download
      .
    2. Locate and
      Download
      the model-specific file for the release version to which you are upgrading. For example, to upgrade an M-Series appliance to Panorama 8.1, download the
      Panorama_m-8.1.0
      image; to upgrade a Panorama virtual appliance to Panorama 8.1, download the
      Panorama_pc-8.1.0
      image. After a successful download, the Action column changes from
      Download
      to
      Install
      for the downloaded image.
    3. (
      Required for the target release; also required for the base image—Panorama 8.1—if you manually download or upload the base image when upgrading to a Panorama 8.1 release
      ) Install the downloaded image and then reboot.
      1. Install the image.
      2. After the installation completes successfully, reboot using one of the following methods:
        • If prompted to reboot, click Yes. If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the username and password you specified during initial configuration.
        • If you are not prompted to reboot,
          Reboot Panorama
          from the Device Operations section (
          Panorama
          Setup
          Operations
          ).
    4. (
      Required only if upgrading to PAN-OS 8.1.1 or a later release
      ) After completing the above steps for the PAN-OS 8.1 base image, repeat steps 1 through 3 to upgrade to the target maintenance release.
  7. (
    Panorama on Azure only
    ) Load the exported Panorama config from Step 2.
    1. Import named Panorama configuration snapshot
      (
      Panorama
      Setup
      Operations
      ),
      Browse
      and select the Panorama configuration file, and click
      OK
      .
    2. Load named Panorama configuration snapshot
      , select the
      Name
      of the configuration you just imported, enter the
      Decryption Key
      if required and click
      OK
      .
    3. Commit the Panorama configuration by enter the following commands:
      admin>
      configure
      admin>
      commit force
  8. (
    Best Practice
    ) Schedule recurring, automatic content updates.
    Panorama does not synchronize content update schedules across HA peers. You must perform this task on both the active and passive Panorama.
    In the header row for each update type (
    Panorama
    Dynamic Updates
    ), the
    Schedule
    is initially set to
    None
    . Perform the following steps for each update type.
    1. Click
      None
      and select the update frequency (
      Recurrence
      ). The frequency options depend on the update type.
    2. Select the schedule action:
      • Download And Install
        (
        Best Practice
        )—Panorama automatically installs updates after downloading them.
      • Download Only
        —You must manually install updates after Panorama downloads them.
    3. Based on the best practices for the security posture of your organization, configure a delay (
      Threshold
      ) after an update becomes available before Panorama downloads the update.
    4. Click
      OK
      to save your changes.
    5. Select
      Commit
      Commit to Panorama
      and
      Commit
      your changes.
  9. (Required if you upgraded from a 7.1 or earlier release)
    Migrate Panorama Logs to the New Log Format.
    When you upgrade to a Panorama 8.0 or later release, Panorama Log Collectors use a new log storage format. Because Panorama can no longer generate reports or ACC data from logs in the pre-8.0-release log format, you must migrate the existing logs as soon as you upgrade Panorama and its Log Collectors from a PAN-OS 7.1 or earlier release to a PAN-OS 8.0 or later release. Log migration is a one-time task; after you migrate the logs on the Log Collector as part an upgrade to a PAN-OS 8.0 or later release, you do not need to migrate them again.

Related Documentation