Install Updates for Panorama When Not Internet-Connected

If Panorama™ does not have a direct connection to the internet, perform the following steps to install Panorama software and content updates as needed. If Panorama is deployed in a high availability (HA) configuration, you must upgrade each peer (see Install Updates for Panorama in an HA Configuration).
Upgrading the software on the Panorama virtual appliance does not change the system mode; switching to Panorama mode or Management Only mode is a manual task that requires additional settings as described when you Set Up the Panorama Virtual Appliance with Local Log Collector.
PAN-OS® 9.0 introduces a new log data format for local and Dedicated Log Collectors. When you upgrade to PAN-OS 9.0, existing log data is automatically migrated to the new PAN-OS 9.0 format. During reformatting, log data is not visible in the
ACC
or
Monitor
tabs. Additionally, new log data is not forwarded to Log Collectors until reformatting is complete. While the reformatting takes place, new logs are written to the firewall system disk and after the procedure is successfully completed, the new logs are forwarded to the appropriate Log Collector.
You must upgrade all Log Collectors in a collector group at the same time to avoid losing log data loss. No log forwarding or log collection occurs if the Log Collectors in a collector group are not all running the same PAN-OS version. Additionally, the log data for the Log Collectors in the collector group is not visible in the
ACC
or
Monitor
tabs until all Log Collectors are running the same PAN-OS version. For example, if you have three Log Collectors in a collector group and you upgrade two of the Log Collectors, then no logs are forwarded to any Log Collectors in the collector group.
Before you upgrade Panorama, refer to the Release Notes for the minimum content release version required for PAN-OS® 9.0.
For Panorama on Azure, you must perform additional steps before you can successfully upgrade the software version. To upgrade, you need to export the Panorama configuration, upgrade the content and software versions, and import the configuration to the Panorama management server after you successfully upgrade.
For M-100 appliances, Palo Alto Networks requires upgrading the memory to 32GB or more for management and log collection tasks. See the M-100 Memory Upgrade Guide before upgrading your M-100 appliance to PAN-OS 9.0.0.
  1. Verify that the updates you plan to install are appropriate for your Panorama deployment.
  2. Save a backup of the current Panorama configuration file that you can use to restore the configuration if you have problems with the upgrade.
    Although Panorama automatically creates a backup of the configuration, best practice is to create and externally store a backup before you upgrade.
    1. Save named Panorama configuration snapshot
      (
      Panorama
      Setup
      Operations
      ), enter a
      Name
      for the configuration, and click
      OK
      .
    2. Export named Panorama configuration snapshot
      , select the
      Name
      of the configuration you just saved, click
      OK
      , and save the exported file to a location that is external to Panorama.
  3. Determine which content updates you need to install.
    Palo Alto Networks highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version.
    1. For each content update, determine whether you need updates and which content updates you need to download in the following step.
      Ensure that Panorama is running the same but not a later content release version than is running on managed firewalls and Log Collectors.
    2. (
      As needed
      ) Before you update the content release version on Panorama, be sure to upgrade managed firewalls and then Log Collectors (see Upgrade Log Collectors When Panorama Is Internet-Connected) to the same (or a later) content release version.
  4. You cannot skip the installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 9.0. Review the known issues and changes to default behavior in the Release Notes and upgrade/downgrade considerations in the New Features Guide for each release through which you pass as part of your upgrade path.
    (
    Required if you are upgrading from a 7.1 or earlier release
    ) PAN-OS 8.0 introduced a new log storage format. After upgrading to PAN-OS 8.0, you must Migrate Panorama Logs to the New Log Format before continuing in your upgrade path. Log migration is a one-time task; if you already migrated the logs on the Log Collector for an upgrade to PAN-OS 8.0, you do not need to migrate them again.
    If upgrading more than one Log Collector, streamline the process by determining the upgrade paths for all Log Collectors you intend to upgrade before you start downloading images.
  5. (
    As needed
    ) Download content updates to a host that can connect and upload content to Panorama either over SCP or HTTPS.
    If you do not need to install content updates at this time, then skip ahead to 6.
    1. Use a host that has internet access to log in to the Palo Alto Networks Customer Support website.
    2. Download content updates as needed:
      1. Click
        Updates
        Dynamic Updates
        in the Resources section.
      2. Download
        the appropriate content updates and save the files to the host. Perform this step for each content type you need to update.
  6. Install content updates as needed.
    You must install content updates before software updates and you must Upgrade Firewalls first and then Upgrade Log Collectors before you install them on the Panorama management server.
    Install the Applications or Applications and Threats update first, and then install any other updates (Antivirus, WildFire®, and URL Filtering), one at a time, and in any sequence.
    Regardless whether your subscription includes both Applications and Threats content, Panorama installs and needs only the Applications content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
    In Panorama (
    Panorama
    Dynamic Updates
    ), perform the following steps for each content type:
    1. Click
      Upload
      , select the content
      Type
      ,
      Browse
      to the location on the host to which you downloaded the update, select the update, and click
      OK
      .
    2. Install From File
      , select the
      Package Type
      , and click
      OK
      .
  7. Download the software updates to a host that can connect and upload content to Panorama either over SCP or HTTPS.
    1. Use a host with internet access to log in to the Palo Alto Networks Customer Support web site.
    2. Download software updates:
      1. On the main page of Palo Alto Networks Customer Support website, click
        Updates
        Software Updates
        .
      2. For the first (or next) Panorama release in your upgrade path, identify the model-specific file. For example, to upgrade an M-Series appliance to Panorama 9.0.0, download the
        Panorama_m-9.0.0
        image; to upgrade a Panorama virtual appliance to Panorama 9.0.0, download the
        Panorama_pc-9.0.0
        image.
        You can quickly locate Panorama images by selecting
        Panorama M Images
        (M-Series appliances) or
        Panorama Updates
        (virtual appliances) from the
        Filter By
        drop-down.
      3. Click the filename and save the file to the host.
      4. Repeat substep 2 above for any additional release versions in your upgrade path as determined in Step 4.
  8. Install Panorama 9.0.
    For each release in your upgrade path (starting with the earliest), perform the following steps:
    1. Click Upload (
      Panorama
      Software
      ).
    2. Browse
      to the location on the host to which you downloaded the update, select the update,
      Sync To Peer
      if Panorama is in an HA configuration (to push the software image to the secondary peer), and click
      OK
      .
    3. Install the software image and reboot.
      For an HA configuration, Install Updates for Panorama in an HA Configuration; otherwise:
      1. Install the downloaded image.
      2. After you successfully complete the installation, reboot using one of the following methods:
        • If prompted to reboot, click
          Yes
          . If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the username and password you specified during initial configuration.
        • If you are not prompted to reboot,
          Reboot Panorama
          from the Device Operations section (
          Panorama
          Setup
          Operations
          ).
    4. Repeat substeps 1 through 3 above for each release in your path as needed.
  9. Check the status of the log format migration after a successfully upgrade to PAN-OS 9.0.
    1. Log in to the Panorama CLI of the Log Collector.
    2. Run the following command to check the status of the log format migration:
      admin>
      debug logdb show-es-upgrade-time
      Example response when the log format migration is still in progress:
      Response from logger 23456212: 50.98% of indices upgraded complete. Approximately less than a minute remaining until migration is complete. Once the log migration is complete, please run the ‘show log-collector-es-cluster health’ command to check the ElasticSearch cluster status to verify logging and reporting functionality is restored.
      Response when the log format migration is completed:
      Response from logger 23456212: 100% of indices complete. Please run the ‘show log-collector-es-cluster health’ command to check the ElasticSearch cluster status to verify logging and reporting functionality is restored.
    3. After log format migration is completee, run the following command to check the status of the ElasticSearch cluster before you continue to the next step:
      admin>
      show log-collector-es-cluster health
      Continue to the next step when the
      “status”
      of the ElasticSearch cluster health displays
      “green”
      :
      es-cluster-health-example.png
  10. (
    Panorama on Azure only
    ) Load the exported Panorama configuration from Step 2.
    1. Import named Panorama configuration snapshot
      (
      Panorama
      Setup
      Operations
      ),
      Browse
      and select the Panorama configuration file, and click
      OK
      .
    2. Load named Panorama configuration snapshot
      , select the
      Name
      of the configuration you just imported, enter the
      Decryption Key
      if required and click
      OK
      .
    3. Commit the Panorama configuration by enter the following commands:
      admin>
      configure
      admin>
      commit force
  11. (
    If local Log Collector is in a Collector Group
    ) Upgrade the remaining Log Collectors in the Collector Group.

Related Documentation