Install Updates for Panorama When Not Internet-Connected

Determine the Upgrade Path to PAN-OS 9.0.
You cannot skip the installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 9.0. Review the known issues and changes to default behavior in the Release Notes and upgrade/downgrade considerations in the New Features Guide for each release through which you pass as part of your upgrade path.
Verify that the updates you plan to install are appropriate for your Panorama deployment.
Palo Alto Networks highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version.
Refer to the Release Notes for the minimum content release version you must install for a Panorama software release. If you intend to upgrade Log Collectors and firewalls to a particular release, you must first upgrade Panorama to that (or a later) release.
For a Panorama virtual appliance, ensure that the instance meets the Setup Prerequisites for the Panorama Virtual Appliance.
Save a backup of the current Panorama configuration file that you can use to restore the configuration if you have problems with the upgrade.
Although Panorama automatically creates a backup of the configuration, best practice is to create and externally store a backup before you upgrade.
Log in to the Panorama Web Interface.
Save named Panorama configuration snapshot
(
Panorama
Setup
Operations
), enter a
Name
for the configuration, and click
OK
.
Export named Panorama configuration snapshot
, select the
Name
of the configuration you just saved, click
OK
, and save the exported file to a location that is external to Panorama.
Download content updates to a host that can connect and upload content to Panorama either over SCP or HTTPS.
If you do not need to install content updates at this time, then skip ahead to 5.
Use a host that has internet access to log in to the Palo Alto Networks Customer Support website.
Download content updates as needed:
Click
Updates
Dynamic Updates
in the Resources section.
Download
the appropriate content updates and save the files to the host. Perform this step for each content type you need to update.
Install content updates as needed.
You must install content updates before software updates and you must Upgrade Firewalls first and then Upgrade Log Collectors before you install them on the Panorama management server.
Install the Applications or Applications and Threats update first, and then install any other updates (Antivirus, WildFire®, and URL Filtering), one at a time, and in any sequence.
Regardless whether your subscription includes both Applications and Threats content, Panorama installs and needs only the Applications content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
Log in to the Panorama web interface and perform the following steps for each content type:
Select
Panorama
Dynamic Updates
Click
Upload
, select the content
Type
,
Browse
to the location on the host to which you downloaded the update, select the update, and click
OK
.
Install From File
, select the
Package Type
, and click
OK
.
Upgrade the Log Collector to the PAN-OS releases along your upgrade path to PAN-OS 9.0.
If upgrading more than one Log Collector, streamline the process by determining the upgrade paths for all Log Collectors you intend to upgrade before you start downloading images.
Install Updates for Panorama When Not Internet Connected to PAN-OS 8.1.
Download the software updates to a host that can connect and upload content to Panorama either over SCP or HTTPS.
Use a host with internet access to log in to the Palo Alto Networks Customer Support web site.
Download software updates:
On the main page of Palo Alto Networks Customer Support website, click
Updates
Software Updates
.
For the first (or next) Panorama release in your upgrade path, identify the model-specific file. For example, to upgrade an M-Series appliance to Panorama 9.0.0, download the
Panorama_m-9.0.0
image; to upgrade a Panorama virtual appliance to Panorama 9.0.0, download the
Panorama_pc-9.0.0
image.
You can quickly locate Panorama images by selecting
Panorama M Images
(M-Series appliances) or
Panorama Updates
(virtual appliances) from the
Filter By
drop-down.
Click the filename and save the file to the host.
Upgrade Panorama to PAN-OS 9.0.
Log in to the Panorama Web Interface.
Select
Panorama
Software
and
Upload
the PAN-OS 9.0 image you downloaded in the previous step.
Browse
to the location on the host to which you downloaded the update, select the update,
Sync To Peer
if Panorama is in an HA configuration (to push the software image to the secondary peer), and click
OK
.
Install the software image and reboot.
For an HA configuration, Install Updates for Panorama in an HA Configuration; otherwise:
Install
the downloaded image.
After you successfully complete the installation, reboot using one of the following methods:
If prompted to reboot, click
Yes
. If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the username and password you specified during initial configuration.
If you are not prompted to reboot,
Reboot Panorama
from the Device Operations section (
Panorama
Setup
Operations
).
Repeat substeps 1 through 3 above for each release in your path as needed.
Check the status of the log format migration after a successfully upgrade to PAN-OS 9.0.
Log in to the Panorama CLI of the Log Collector.

Run the following command to check the status of the log format migration:

admin> 
debug logdb show-es-upgrade-time

Example response when the log format migration is still in progress:

Response from logger 23456212: 50.98% of indices upgraded complete. Approximately less than a minute remaining until migration is complete. Once the log migration is complete, please run the ‘show log-collector-es-cluster health’ command to check the ElasticSearch cluster status to verify logging and reporting functionality is restored.

Response when the log format migration is completed:

Response from logger 23456212: 100% of indices complete. Please run the ‘show log-collector-es-cluster health’ command to check the ElasticSearch cluster status to verify logging and reporting functionality is restored.

After log format migration is completee, run the following command to check the status of the ElasticSearch cluster before you continue to the next step:

admin> 
show log-collector-es-cluster health

Continue to the next step when the

“status”

of the ElasticSearch cluster health displays

“green”

:


(
Panorama Virtual Appliance on Azure with VM-Series Plugin only installed only
) If you are upgrading Panorama to PAN-OS 9.0.5 or later release, upgrade the VM-Series plugin to VM-Series plugin 1.0.5 or later release.
(
Panorama on Azure only
) Load the exported Panorama configuration from Step 2.
Import named Panorama configuration snapshot

(

Panorama

Setup

Operations

),

Browse

and select the Panorama configuration file, and click

OK

.

Load named Panorama configuration snapshot

, select the

Name

of the configuration you just imported, enter the

Decryption Key

if required and click

OK

.

Log in to the Panorama CLI.

Commit the Panorama configuration by enter the following commands:

admin> 
configure

admin> 
commit force
(
If local Log Collector is in a Collector Group
) Upgrade the remaining Log Collectors in the Collector Group.
Upgrade Log Collectors When Panorama Is Internet-Connected
Upgrade Log Collectors When Panorama Is Not Internet-Connected