Downgrade from Panorama 8.1.0

Procedure on how to downgrade from Panorama 8.1 to Panorama 8.0.
Panorama 8.1 introduced enhanced template and template stack capabilities, rule usage tracking, and device monitoring tracking for managed firewalls. However, these features are not compatible with Panorama running a release earlier than Panorama 8.1. Use the following workflow to downgrade firewalls before you downgrade Log Collectors and Panorama running a Panorama 8.1 release to an earlier feature release. This procedure works for both Panorama managing a local Log Collector and managing one or more Dedicated Log Collectors.
Review the Palo Alto Networks Compatibility Matrix to confirm that the firewalls and appliances you intended to downgrade are compatible with PAN-OS release version you intend to downgrade to. For example, PA-220, PA-800 Series, PA-5200 Series and some VM-Series firewalls are not supported on any release earlier than PAN-OS 8.0 and you cannot manage these firewalls from Panorama after you downgrade Panorama to Panorama 7.1. For the firewalls and appliances that you can downgrade, you should also review the Upgrade/Downgrade Considerations to ensure that you account for all features and configuration settings that will be different or unavailable after you downgrade.
  1. Save a backup of the Panorama and managed devices configuration files.
    1. Export Panorama and device configuration snapshot (PanoramaSetupOperations).
    2. Save the exported .tgz file to a location external to Panorama, Log Collectors, or firewalls. You can use this backup to restore the configuration if you experience problems that cause you to start over.
  2. (Panorama and Log Collectors running Panorama 8.0 or 8.0.1 only) Upgrade Panorama and Log Collectors to Panorama 8.0.2 or later release.
    1. Install Content and Software Updates for Panorama.
    2. Upgrade Log Collectors When Panorama Is Internet-Connected.
  3. Save a backup of the Panorama and managed devices configuration files.
    1. Export Panorama and device configuration snapshot (PanoramaSetupOperations).
    2. Save the exported .tgz file to a location external to Panorama, Log Collectors, or firewalls. You can use this backup to restore the configuration if you experience problems that cause you to start over.
  4. Downgrade each firewall running a PAN-OS 8.1 release.
    If downgrading more than one firewall, streamline the process by having each firewall-specific PAN-OS 8.0 image downloaded to Panorama before you start downgrading. For example, to downgrade your PA-200, PA-3050, and PA-5060 firewalls to PAN-OS 8.0, download the PanOS_700-8.0.2, PanOS_3000-8.0.2, and PanOS_5000-8.0.2 images.
    Panorama requires that all firewalls are running the same or an earlier PAN-OS release. Thus, before you can downgrade Panorama, use and repeat the appropriate tasks below according to your environment to downgrade all managed firewalls:
    1. Check Now for available images (PanoramaDevice DeploymentSoftware).
    2. Locate the PAN-OS 8.0 image for each model or series of firewalls you intend to downgrade. If the image is not already downloaded, then Download it.
    Non-HA Firewalls
    Click Install in the Action column for the PAN-OS 8.0 version, select all the firewalls you intend to downgrade, select Reboot device after install, and click OK.
    Active/Active HA Firewalls
    1. Click Install, disable (clear) Group HA Peers, select either of the HA peers, select Reboot device after install, and click OK. Wait for the firewall to finish rebooting before you proceed.
    2. Click Install, disable (clear) Group HA Peers, select the HA peer that you didn’t update in the previous step, select Reboot device after install, and click OK.
    Active/Passive HA Firewalls
    In this example, the active firewall is named fw1 and the passive firewall is named fw2:
    1. Click Install in the Action column for the appropriate update, clear Group HA Peers, select fw2, select Reboot device after install, and click OK.
    2. After fw2 finishes rebooting, verify fw1 (DashboardHigh Availability widget) that fw2 is still the passive peer (the Local firewall state is active and the Peer-fw2 is passive).
    3. Access fw1 and Suspend local device (DeviceHigh AvailabilityOperational Commands).
    4. Access fw2 (DashboardHigh Availability widget) and verify that the Local firewall state is active and the Peer firewall is suspended.
    5. Access Panorama, select PanoramaDevice DeploymentSoftware, click Install in the Action column for the appropriate update, clear Group HA Peers, select fw1, select Reboot device after install, and click OK. Wait for fw1 to finish rebooting before you proceed.
    6. Access fw1 (DashboardHigh Availability widget) and verify that the Local firewall state is passive and the Peer (fw2) is active.
      If you enabled preemption in the Election settings (DeviceHigh AvailabilityGeneral), then fw1 will be reinstated as the active peer after reboot.
  5. Downgrade each Log Collector running Panorama 8.1.
    1. Check Now for available images (PanoramaDevice DeploymentSoftware).
    2. Locate the Panorama 8.0 image. If the image is not already downloaded, then Download it (Action column).
    3. After the download completes, Install the image on each Log Collector running Panorama 8.1. Select Reboot device after install to automatically reboot the device when the upgrade has completed.
  6. Downgrade Panorama.
    1. Check Now for available images (PanoramaDevice DeploymentSoftware).
    2. Locate the Panorama 8.0 image. If the image is not already downloaded, then Download it.
    3. After the download completes, Install the image on Panorama.
    4. Reboot Panorama if the downgrade requires that:
      • If prompted to reboot, click Yes. If you see a CMS Login prompt, press Enter without typing the username or password. When the Panorama login prompt appears, enter the username and password you set during initial configuration.
      • If you are not prompted to reboot, select PanoramaSetupOperations and click Reboot Panorama in the Device Operations section.

Related Documentation