Install Updates for Panorama When Not Internet-Connected
If Panorama™ does not have a direct connection to the internet, perform the following steps to install Panorama software and content updates as needed. If Panorama is deployed in a high availability (HA) configuration, you must upgrade each peer (see Install Updates for Panorama in an HA Configuration).
Upgrading the software on the Panorama virtual appliance does not change the system mode; switching to Panorama mode or Management Only mode is a manual task that requires additional settings as described when you Set Up the Panorama Virtual Appliance with Local Log Collector.
Before updating Panorama, refer to the Release Notes for the minimum content release version required for PAN-OS® 8.1.
For Panorama on Azure, additional steps must be taken to successfully upgrade the software version. To upgrade, you need to export the Panorama configuration, upgrade the content and software versions, and import the configuration to the Panorama management server once you successfully upgrade.
- Verify that the updates you plan to install are
appropriate for your Panorama deployment.
- For a Panorama virtual appliance that runs on an ESXi server, ensure that the server meets the Setup Prerequisites for the Panorama Virtual Appliance.
- Save a
backup of the current Panorama configuration file that you can use
to restore the configuration if you have problems with the upgrade.Although Panorama automatically creates a backup of the configuration, best practice is to create and externally store a backup before you upgrade.
- Save named Panorama configuration snapshot (PanoramaSetupOperations), enter a Name for the configuration, and click OK.
- Export named Panorama configuration snapshot, select the Name of the configuration you just saved, click OK, and save the exported file to a location that is external to Panorama.
which content updates you need to install.Palo Alto Networks highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version.
- For each content update, determine whether
you need updates and which content updates you need to download
in the following step.Ensure that Panorama is running the same but not a later content release version than is running on managed firewalls and Log Collectors.
- (As needed) Before you update the content release version on Panorama, be sure to upgrade managed firewalls and then Log Collectors (see Upgrade Log Collectors When Panorama Is Internet-Connected) to the same (or a later) content release version.
- For each content update, determine whether you need updates and which content updates you need to download in the following step.
- (As needed) Download content
updates to a host that can connect and upload content to Panorama
either over SCP or HTTPS.If you do not need to install content updates at this time, then skip ahead to 6.
- Use a host that has internet access to log in to the Palo Alto Networks Customer Support website.
- Download content updates as needed:
- Click UpdatesDynamic Updates in the Resources section.
- Download the appropriate content updates and save the files to the host. Perform this step for each content type you need to update.
- Install content updates as needed.Install the Applications or Applications and Threats update first, and then install any other updates (Antivirus, WildFire,® and URL Filtering), one at a time, and in any sequence.Regardless whether your subscription includes both Applications and Threats content, Panorama installs and needs only the Applications content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.In Panorama (PanoramaDynamic Updates), perform the following steps for each content type:
- Click Upload, select the content Type, Browse to the location on the host to which you downloaded the update, select the update, and click OK.
- Install From File, select the Package Type, and click OK.
- Determine the upgrade path to PAN-OS 8.1.
Refer to the New Features Guide for the upgrade path
to a PAN-OS 8.1 release.Check which version has a check mark in the Currently Installed column (PanoramaSoftware) and make a list of all versions in your upgrade path that you need to download from the Palo Alto Networks update server so that you can upload each to the appliance as needed when you upgrade.
- Download the software updates to a host that can connect
and upload content to Panorama either over SCP or HTTPS.
- Use a host with internet access to log in to the Palo Alto Networks Customer Support web site.
- Download software updates:
- On the main page of Palo Alto Networks Customer Support website, click UpdatesSoftware Updates.
- For the first (or next) Panorama release in your upgrade path, identify the model-specific file. For example, to upgrade an M-Series appliance to Panorama 8.0.8, download the Panorama_m-8.0.8 image; to upgrade a Panorama virtual appliance to Panorama 8.0.8, download the Panorama_pc-8.0.8 image.You can quickly locate Panorama images by selecting Panorama M Images (M-Series appliances) or Panorama Updates (virtual appliances) from the Filter By drop-down.
- Click the filename and save the file to the host.
- Install the software updates.For each release in your upgrade path (starting with the earliest), perform the following steps:
- Click Upload (PanoramaSoftware).
- Browse to the location on the host to which you downloaded the update, select the update, Sync To Peer if Panorama is in an HA configuration (to push the software image to the secondary peer), and click OK.
- Install the software image and
reboot.For an HA configuration, Install Updates for Panorama in an HA Configuration; otherwise:
- Install the downloaded image.
- After you successfully complete the installation, reboot using one of the following methods:
- If prompted to reboot, click Yes. If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the username and password you specified during initial configuration.
- If you are not prompted to reboot, Reboot Panorama from the Device Operations section (PanoramaSetupOperations).
- Repeat steps 8.1 through 8.3 for each release in your path.
- (Panorama on Azure only) Load the exported Panorama
config from Step 2.
- Import named Panorama configuration snapshot (PanoramaSetupOperations), Browse and select the Panorama configuration file, and click OK.
- Load named Panorama configuration snapshot, select the Name of the configuration you just imported, enter the Decryption Key if required and click OK.
- Log in to the Panorama CLI.
- Commit the Panorama configuration by enter the following
admin> commit force
- (Required if you upgraded from a 7.1 or earlier release)Migrate Panorama Logs
to the New Log Format.When you upgrade to a Panorama 8.0 or later release, Panorama Log Collectors use a new log storage format. Because Panorama can no longer generate reports or ACC data from logs in the pre-8.0-release log format, you must migrate the existing logs as soon as you upgrade Panorama and its Log Collectors from a PAN-OS 7.1 or earlier release to a PAN-OS 8.0 or later release. Log migration is a one-time task; after you migrate the logs on the Log Collector as part an upgrade to a PAN-OS 8.0 or later release, you do not need to migrate them again.
Upgrade Log Collectors When Panorama Is Internet-Connected
Upgrade Log Collector software to PAN-OS® 8.1 and install content updates using Panorama™ when Panorama is connected to the internet. ...
Install Updates for Panorama with an Internet Connection
Install Updates for Panorama with an Internet Connection If Panorama™ has a direct connection to the internet, perform the following steps to install Panorama software ...
Upgrade Log Collectors When Panorama Is Not Internet-Connec...
Upgrade Log Collector software to PAN-OS® 8.1 and install content updates using Panorama™ when Panorama is not connected to the internet. ...
Upgrade Firewalls When Panorama Is Not Internet-Connected
Upgrade firewall software to PAN-OS® 8.1 and install content updates using Panorama™ when Panorama is not connected to the internet. ...
Upgrade Firewalls When Panorama is Internet-Connected
Procedure to upgrade managed firewalls when Panorama is Internet connected. ...
Deploy Upgrades to Firewalls, Log Collectors, and WildFire Appliances Using Panorama
Use Panorama™ to test software and content updates on a subset of firewalls and Dedicated Log Collectors before you deploy to all your firewalls and ...
Install Updates for Panorama in an HA Configuration
Install Updates for Panorama in an HA Configuration To ensure a seamless failover when you update the Panorama software in a high availability (HA) configuration, ...
Upgrade Firewalls Using Panorama
Upgrade Firewalls Using Panorama Review the PAN-OS 8.1 Release Notes and then use the following procedure to upgrade firewalls that you manage with Panorama. This ...
Manage Software and Content Updates
Manage Software and Content Updates Panorama > Device Deployment > Software Panorama provides the following options for deploying software and content updates to firewalls and ...