Install Updates for Panorama in an HA Configuration

To ensure a seamless failover when you update the Panorama software in a high availability (HA) configuration, the active and passive Panorama peers must be running the same Panorama release with the same Applications database version. The following example describes how to upgrade an HA pair (active peer is Primary_A and passive peer is Secondary_B).
Before updating Panorama, refer to the Release Notes. for the minimum content release version required for PAN-OS 9.0.
For M-100 appliances, Palo Alto Networks requires upgrading the memory to 32GB or more for management and log collection tasks. See the M-100 Memory Upgrade Guide before upgrading your M-100 appliance to PAN-OS 9.0.0.
  1. Upgrade the Panorama software on the Secondary_B (passive) peer.
    Perform one of the following tasks on the Secondary_B peer:
    After the upgrade, this Panorama transitions to a non-functional state because the peers are no longer running the same software release.
  2. Suspend the Primary_A peer to force a failover.
    On the Primary_A peer:
    1. In the
      Operational Commands
      section (
      Panorama
      High Availability
      ),
      Suspend local Panorama
      .
    2. Verify that state is
      suspended
      (displayed on bottom-right corner of the web interface).
      The resulting failover should cause the Secondary_B peer to transition to
      active
      state.
  3. Upgrade the Panorama software on the Primary_A (currently passive) peer.
    Perform one of the following tasks on the Primary_A peer:
    After you reboot, the Primary_A peer is initially still in the passive state. Then, if preemption is enabled (default), the Primary_A peer automatically transitions to the active state and the Secondary_B peer reverts to the passive state.
    If you disabled preemption, manually Restore the Primary Panorama to the Active State.
  4. Verify that both peers are now running any newly installed content release versions and the newly installed Panorama release.
    On the
    Dashboard
    of each Panorama peer, check the Panorama Software Version and Application Version and confirm that they are the same on both peers and that the running configuration is synchronized.
  5. (
    Local Log Collectors in a Collector Group only
    ) Upgrade the remaining Log Collectors in the Collector Group.

Related Documentation