Install Updates for Panorama with an Internet Connection
If Panorama™ has a direct connection to the internet, perform the following steps to install Panorama software and content updates as needed. If Panorama is running in a high availability (HA) configuration, upgrade the Panorama software on each peer (see Install Updates for Panorama in an HA Configuration).
Upgrading the software on the Panorama virtual appliance does not change the system mode; switching to Panorama mode or Management Only mode is a manual task that requires additional settings as described when you Set Up the Panorama Virtual Appliance with Local Log Collector.
PAN-OS® 9.0 introduces a new log data format for local and Dedicated Log Collectors. When you upgrade to PAN-OS 9.0, existing log data is automatically migrated to the new PAN-OS 9.0 format. During reformatting, log data is not visible in the ACC or Monitor tabs. Additionally, new log data is not forwarded to Log Collectors until reformatting is complete. While the reformatting takes place, new logs are written to the firewall system disk and after the procedure is successfully completed, the new logs are forwarded to the appropriate Log Collector.
You must upgrade all Log Collectors in a collector group at the same time to avoid losing log data loss. No log forwarding or log collection occurs if the Log Collectors in a collector group are not all running the same PAN-OS version. Additionally, the log data for the Log Collectors in the collector group is not visible in the ACC or Monitor tabs until all Log Collectors are running the same PAN-OS version. For example, if you have three Log Collectors in a collector group and you upgrade two of the Log Collectors, then no logs are forwarded to any Log Collectors in the collector group.
Before updating Panorama, refer to the Release Notes. for the minimum content release version required for PAN-OS 9.0.
For Panorama on Azure, you must perform additional steps before you can successfully upgrade the software version. To upgrade, you need to export the Panorama configuration, upgrade the content and software versions, and import the configuration to the Panorama management server after you successfully upgrade.
For M-100 appliances, Palo Alto Networks requires upgrading the memory to 32GB or more for management and log collection tasks. See the M-100 Memory Upgrade Guide before upgrading your M-100 appliance to PAN-OS 9.0.0.
- Verify that the updates you plan to install are
appropriate for your Panorama deployment.
- For a Panorama virtual appliance that runs on a hypervisor, ensure that the instance meets the Setup Prerequisites for the Panorama Virtual Appliance.
- Save a
backup of the current Panorama configuration file that you can use
to restore the configuration if you have problems with the upgrade.Although Panorama automatically creates a backup of the configuration, best practice is to create and externally store a backup before you upgrade.
- Save named Panorama configuration snapshot (PanoramaSetupOperations), enter a Name for the configuration, and click OK.
- Export named Panorama configuration snapshot, select the Name of the configuration you just saved, click OK, and save the exported file to a location that is external to Panorama.
- (As needed) Install content updates.If Panorama is not running the minimum content versions required for the Panorama release to which you intend to upgrade, you must update content versions to the minimum (or later) versions before you install the software updates. Refer to Release Notes for minimum content release version for a Panorama release.Palo Alto Networks® highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version. Additionally, we recommend that you schedule automatic, recurring updates so that you are always running the latest content versions (refer to 9).
- Check Now (PanoramaDynamic Updates)
for the latest updates. If the value in the Action column is Download,
an update is available.Ensure that Panorama is running the same but not a later content release version than is running on managed firewalls and Log Collectors.
- (As needed) Before you update the content
release version on Panorama, be sure to upgrade managed firewalls and then
Log Collectors (see Upgrade
Log Collectors When Panorama Is Internet-Connected) to the
same (or a later) content release version.If you do not need to install content updates at this time, then skip ahead to the next step.
- Install remaining content updates, as needed. When
installed, the Currently Installed column displays a check mark.
- Download and Install the Applications or Applications and Threats update. Regardless of your subscription, Panorama installs and needs only the Applications content update, not the Threats content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
- Download and Install other updates (Antivirus, WildFire®, or URL Filtering) as needed, one at a time, and in any sequence.
- Check Now (PanoramaDynamic Updates) for the latest updates. If the value in the Action column is Download, an update is available.
- Determine the Upgrade Path to
PAN-OS 9.0.You cannot skip the installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 9.0. Review the known issues and changes to default behavior in the Release Notes and upgrade/downgrade considerations in the New Features Guide for each release through which you pass as part of your upgrade path.(Required if you are upgrading from a 7.1 or earlier release) PAN-OS 8.0 introduced a new log storage format. After upgrading to PAN-OS 8.0, you must Migrate Panorama Logs to the New Log Format before continuing in your upgrade path. Log migration is a one-time task; if you already migrated the logs on the Log Collector for an upgrade to PAN-OS 8.0, you do not need to migrate them again.If upgrading more than one Log Collector, streamline the process by determining the upgrade paths for all Log Collectors you intend to upgrade before you start downloading images.
- Check Now (PanoramaSoftware) for the latest releases. If a software release is available, the Action column displays Download.
- Locate and Download the model-specific file for the release version to which you are upgrading. For example, to upgrade an M-Series appliance to Panorama 9.0.0, download the Panorama_m-9.0.0 image; to upgrade a Panorama virtual appliance to Panorama 9.0.0, download the Panorama_pc-9.0.0 image. After a successful download, the Action column changes from Download to Install for the downloaded image.
- (You cannot skip installation
of any feature release versions in the path from the currently running
PAN-OS version to PAN-OS 9.0.0.) Install the downloaded image
and then reboot.
- Install the image.
- After the installation completes successfully, reboot using one of the following methods:
- If prompted to reboot, click Yes. If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the username and password you specified during initial configuration.
- If you are not prompted to reboot, Reboot Panorama from the Device Operations section (PanoramaSetupOperations).
- (Required only if upgrading to PAN-OS 9.0.1 or a later release) After you complete the above steps for the PAN-OS 9.0 base image, repeat steps 1 through 3 to upgrade to the target maintenance release.
- Check the status of the log format migration after a
successful upgrade to PAN-OS 9.0.
- Log in to the Panorama CLI of the Log Collector.
- Run the following command to check the status of the
log format migration:
admin> debug logdb show-es-upgrade-timeExample response when the log format migration is still in progress:
Response from logger 23456212: 50.98% of indices upgraded complete. Approximately less than a minute remaining until migration is complete. Once the log migration is complete, please run the ‘show log-collector-es-cluster health’ command to check the ElasticSearch cluster status to verify logging and reporting functionality is restored.Response when the log format migration is completed:
Response from logger 23456212: 100% of indices complete. Please run the ‘show log-collector-es-cluster health’ command to check the ElasticSearch cluster status to verify logging and reporting functionality is restored.
- After the log format migration is complete, run the
following command to check the status of the ElasticSearch cluster
before you continue to the next step:
admin> show log-collector-es-cluster healthContinue to the next step when the “status” of the ElasticSearch cluster health displays “green”:
- (Panorama on Azure only) Load the exported Panorama configuration
from Step 2.
- Import named Panorama configuration snapshot (PanoramaSetupOperations), Browse and select the Panorama configuration file, and click OK.
- Load named Panorama configuration snapshot, select the Name of the configuration you just imported, enter the Decryption Key if required and click OK.
- Log in to the Panorama CLI.
- Commit the Panorama configuration by enter the following commands:
admin> commit force
- (If local Log Collector is in a Collector Group) Upgrade the remaining Log Collectors in the Collector Group.
- (Best Practice) Schedule
recurring, automatic content updates.Panorama does not synchronize content update schedules across HA peers. You must perform this task on both the active and passive Panorama.In the header row for each update type (PanoramaDynamic Updates), the Schedule is initially set to None. Perform the following steps for each update type.
- Click None and select the update frequency (Recurrence). The frequency options depend on the update type.
- Select the schedule action:
- Download And Install (Best Practice)—Panorama automatically installs updates after downloading them.
- Download Only—You must manually install updates after Panorama downloads them.
- Based on the best practices for the security posture of your organization, configure a delay (Threshold) after an update becomes available before Panorama downloads the update.
- Click OK to save your changes.
- Select CommitCommit to Panorama and Commit your changes.
Upgrade Log Collectors When Panorama Is Internet-Connected
Upgrade Log Collector software to PAN-OS® 8.1 and install content updates using Panorama™ when Panorama is connected to the internet. ...
Install Updates for Panorama When Not Internet-Connected
Install Updates for Panorama When Not Internet-Connected If Panorama™ does not have a direct connection to the internet, perform the following steps to install Panorama ...
Upgrade Log Collectors When Panorama Is Not Internet-Connec...
Upgrade Log Collector software to PAN-OS® 8.1 and install content updates using Panorama™ when Panorama is not connected to the internet. ...
Install Updates for Panorama in an HA Configuration
Install Updates for Panorama in an HA Configuration To ensure a seamless failover when you update the Panorama software in a high availability (HA) configuration, ...
Migrate Panorama Logs to the New Log Format
Migrate Panorama Logs to the New Log Format After you upgrade to a Panorama 8.0 or later release, Panorama Log Collectors use a new log ...
Upgrade Firewalls Using Panorama
Follow these steps to upgrade your Panorama-managed firewalls to PAN-OS 9.0. ...
Install Content and Software Updates for Panorama
Install Content and Software Updates for Panorama A valid support subscription enables access to the Panorama software image and release notes. To take advantage of ...
Deploy Upgrades to Firewalls, Log Collectors, and WildFire Appliances Using Panorama
Use Panorama™ to test software and content updates on a subset of firewalls and Dedicated Log Collectors before you deploy to all your firewalls and ...
Upgrade Firewalls When Panorama is Internet-Connected
Procedure to upgrade managed firewalls when Panorama is Internet connected. ...