Downgrade from Panorama 9.0

Save a backup of the configuration files for Panorama and managed devices.

Export Panorama and device configuration snapshot
(
Panorama
Setup
Operations
).
Save the exported .tgz file to a location external to Panorama, Log Collectors, and firewalls. You can use this backup to restore the configuration if you experience problems that cause you to start over.

(

GlobalProtect only

) Delete the GlobalProtect Portal Agent User Override Key.

Downgrade from PAN-OS 9.0 is blocked if the GlobalProtect Portal Agent User Override Key is configured on Panorama. You must delete the Agent User Override Key before you can downgrade Panorama.

Repeat this step for all templates and template stacks containing a GlobalProtect Portal with a Agent User Override Key configured.

Select
Network
GlobalProtect
Portals
and select the
Template
containing the GlobalProtect Portal configuration.
Select
<Portal Name>
Agent
and delete the
Agent User Override Key
.
Click
OK
.
Select
Commit
and
Commit to Panorama
.

Downgrade each firewall running a PAN-OS 9.0 release.

If downgrading more than one firewall, streamline the process by having each firewall-specific PAN-OS 8.1 image downloaded to Panorama before you start downgrading. For example, to downgrade your PA-220 firewall to PAN-OS 8.1.0, download the

PanOS_220-8.1.0

or

PanOS_3000-8.1.0

images.

Panorama requires that all firewalls are running the same or an earlier PAN-OS release. So before you downgrade Panorama, use and repeat the appropriate tasks below according to your environment to downgrade all managed firewalls as needed:

Check Now
for available images (
Panorama
Device Deployment
Software
).
Locate the PAN-OS 8.1 image for each model or series of firewalls you intend to downgrade. If the image is not already downloaded, then
Download
it.

Non-HA Firewalls

Install

(Action column) the appropriate PAN-OS 8.1 version, select all the firewalls you intend to downgrade, select

Reboot device after install

, and click

OK

.

Active/Active HA Firewalls

Click
Install
, disable (clear)
Group HA Peers
, select either of the HA peers, select
Reboot device after install
, and click
OK
. Wait for the firewall to finish rebooting before you proceed.
Click
Install
, disable (clear)
Group HA Peers
, select the HA peer that you didn’t update in the previous step, select
Reboot device after install
, and click
OK
.

Active/Passive HA Firewalls

In this example, the active firewall is named fw1 and the passive firewall is named fw2:

Install
(Action column) the appropriate update, disable (clear)
Group HA Peers
, select fw2, select
Reboot device after install
, and click
OK
.
After fw2 finishes rebooting, verify fw1 (
Dashboard
High Availability
widget) is still the active peer and that fw2 is still the passive peer (the Local firewall state is
active
and the Peer—fw2—is
passive
).
Access fw1 and
Suspend local device
(
Device
High Availability
Operational Commands
).
Access fw2 (
Dashboard
High Availability
) and verify that the Local firewall state is
active
and the Peer firewall—fw1—is
suspended
.
Access Panorama, select
Panorama
Device Deployment
Software
,
Install
(Action column) the appropriate update, disable (clear)
Group HA Peers
, select fw1, select
Reboot device after install
, and click
OK
. Wait for fw1 to finish rebooting before you proceed.
Access fw1 (
Dashboard
High Availability
widget) and verify that the Local firewall state is
passive
and the Peer—fw2—is
active
.
If you enabled preemption in the Election settings (
Device
High Availability
General
), then fw1 will be reinstated as the active peer after reboot.

Downgrade each Log Collector running Panorama 9.0.

Check Now
for available images (
Panorama
Device Deployment
Software
).
Locate the Panorama 8.1 image. If the image is not already downloaded, then
Download
it (Action column).
After the download is complete,
Install
the image on each Log Collector running Panorama 9.0. Select
Reboot device after install
to automatically reboot the device when the upgrade is complete.

Downgrade Panorama.

Check Now
for available images (
Panorama
Device Deployment
Software
).
Locate the Panorama 8.1 image. If the image is not already downloaded, then
Download
it.
After the download is complete,
Install
the image on Panorama.
Reboot Panorama as follows:
If you are prompted to reboot, click
Yes
. If you see a
CMS Login
prompt, press Enter without typing the username or password. When the Panorama login prompt appears, enter the username and password you set during initial configuration.
If you are not prompted to reboot, select
Panorama
Setup
Operations
and click
Reboot Panorama
(Device Operations).

Migrate Panorama logs to the PAN-OS 8.1 log format.

During the migration, log data is not visible in the ACC or Monitor tabs. Additionally, new log data is not forwarded to Log Collectors until the migration is complete.

View the incoming logging rate.

For best results, start log migration when the incoming log rate is low. To check the rate, run the following command from the Log Collector CLI:

admin@FC-M500-1> 
debug log-collector log-collection-stats show incoming-logs

High CPU utilization (close to 100%) during log migration is expected and operations will continue to function normally. Log migration is throttled in favor of incoming logs and other processes in the event of resource contention.

Start migrating the logs on each Log Collector to the previous format.

To begin the migration, enter the following command from the CLI of each Log Collector:

admin@FC-M500-1> 
request logdb migrate lc serial-number 
<ser_num> start

View the log migration status to estimate the amount of time it will take to finish migrating all existing logs to the previous format.

admin@FC-M500-1> 
request logdb migrate lc serial-number 
<ser_num> status Slot: all 
Migration State: In Progress 
Percent Complete: 0.04 
Estimated Time Remaining: 451 hour(s) 47 min(s)