Downgrade from Panorama 9.0
Procedure on how to downgrade from Panorama 9.0 to Panorama
8.1.
PAN-OS® 9.0 introduces master key management
enhancements, rule usage filtering, enforcement of descriptions,
tags and audit comments, and the Audit Comment Archive for policy
rules. However, these features are not compatible with Panorama™
running PAN-OS 8.1 or earlier release. Use the following workflow
to downgrade firewalls before you downgrade Log Collectors and Panorama
running a Panorama 9.0 release to an earlier feature release. This
procedure works both for Panorama when managing a local Log Collector
and for Panorama when managing one or more Dedicated Log Collectors.
PAN-OS
9.0 introduces a new log data format for local and Dedicated Log
Collectors. To downgrade from PAN-OS 9.0 to an earlier release you
must migrate the existing log data to the format supported in PAN-OS
8.0 and PAN-OS 8.1 releases. During the reformatting, log data is
not visible in the
ACC
or Monitor
tabs.
Additionally, new log data is not forwarded to Log Collectors until
the reformatting is complete.Review
the Palo Alto Networks Compatibility Matrix to
confirm that the firewalls and appliances you intend to downgrade
are compatible with the PAN-OS release to which you intend to downgrade.
For example, PA-220, PA-800 Series, PA-5200 Series and some VM-Series
firewalls are not supported on any release earlier than PAN-OS 8.0
and you cannot manage these firewalls from Panorama after you downgrade
Panorama to Panorama 7.1. For the firewalls and appliances that
you can downgrade, you should also review the Upgrade/Downgrade Considerations to
ensure that you account for all features and configuration settings
that will be different or unavailable after you downgrade.
- Save a backup of the configuration files for Panorama and managed devices.
- Export Panorama and device configuration snapshot().PanoramaSetupOperations
- Save the exported .tgz file to a location external to Panorama, Log Collectors, and firewalls. You can use this backup to restore the configuration if you experience problems that cause you to start over.
- Downgrade each firewall running a PAN-OS 9.0 release.If downgrading more than one firewall, streamline the process by having each firewall-specific PAN-OS 8.1 image downloaded to Panorama before you start downgrading. For example, to downgrade your PA-220 firewall to PAN-OS 8.1.0, download thePanOS_220-8.1.0orPanOS_3000-8.1.0images.Panorama requires that all firewalls are running the same or an earlier PAN-OS release. So before you downgrade Panorama, use and repeat the appropriate tasks below according to your environment to downgrade all managed firewalls as needed:
- Check Nowfor available images ().PanoramaDevice DeploymentSoftware
- Locate the PAN-OS 8.1 image for each model or series of firewalls you intend to downgrade. If the image is not already downloaded, thenDownloadit.
Non-HA FirewallsInstall(Action column) the appropriate PAN-OS 8.1 version, select all the firewalls you intend to downgrade, selectReboot device after install, and clickOK.Active/Active HA Firewalls- ClickInstall, disable (clear)Group HA Peers, select either of the HA peers, selectReboot device after install, and clickOK. Wait for the firewall to finish rebooting before you proceed.
- ClickInstall, disable (clear)Group HA Peers, select the HA peer that you didn’t update in the previous step, selectReboot device after install, and clickOK.
Active/Passive HA FirewallsIn this example, the active firewall is named fw1 and the passive firewall is named fw2:- Install(Action column) the appropriate update, disable (clear)Group HA Peers, select fw2, selectReboot device after install, and clickOK.
- After fw2 finishes rebooting, verify fw1 (widget) is still the active peer and that fw2 is still the passive peer (the Local firewall state isDashboardHigh Availabilityactiveand the Peer—fw2—ispassive).
- Access fw1 andSuspend local device().DeviceHigh AvailabilityOperational Commands
- Access fw2 () and verify that the Local firewall state isDashboardHigh Availabilityactiveand the Peer firewall—fw1—issuspended.
- Access Panorama, select,PanoramaDevice DeploymentSoftwareInstall(Action column) the appropriate update, disable (clear)Group HA Peers, select fw1, selectReboot device after install, and clickOK. Wait for fw1 to finish rebooting before you proceed.
- Access fw1 (widget) and verify that the Local firewall state isDashboardHigh Availabilitypassiveand the Peer—fw2—isactive.If you enabled preemption in the Election settings (), then fw1 will be reinstated as the active peer after reboot.DeviceHigh AvailabilityGeneral
- Downgrade each Log Collector running Panorama 9.0.
- Check Nowfor available images ().PanoramaDevice DeploymentSoftware
- Locate the Panorama 8.1 image. If the image is not already downloaded, thenDownloadit (Action column).
- After the download is complete,Installthe image on each Log Collector running Panorama 9.0. SelectReboot device after installto automatically reboot the device when the upgrade is complete.
- Downgrade Panorama.
- Check Nowfor available images ().PanoramaDevice DeploymentSoftware
- Locate the Panorama 8.1 image. If the image is not already downloaded, thenDownloadit.
- After the download is complete,Installthe image on Panorama.
- Reboot Panorama as follows:
- If you are prompted to reboot, clickYes. If you see aCMS Loginprompt, press Enter without typing the username or password. When the Panorama login prompt appears, enter the username and password you set during initial configuration.
- If you are not prompted to reboot, selectand clickPanoramaSetupOperationsReboot Panorama(Device Operations).
- Migrate Panorama logs to the PAN-OS 8.1 log format.During the migration, log data is not visible in the ACC or Monitor tabs. Additionally, new log data is not forwarded to Log Collectors until the migration is complete.
- View the incoming logging rate.For best results, start log migration when the incoming log rate is low. To check the rate, run the following command from the Log Collector CLI:admin@FC-M500-1>debug log-collector log-collection-stats show incoming-logsHigh CPU utilization (close to 100%) during log migration is expected and operations will continue to function normally. Log migration is throttled in favor of incoming logs and other processes in the event of resource contention.
- Start migrating the logs on each Log Collector to the previous format.To begin the migration, enter the following command from the CLI of each Log Collector:admin@FC-M500-1>request logdb migrate lc serial-number<ser_num>start
- View the log migration status to estimate the amount of time it will take to finish migrating all existing logs to the previous format.admin@FC-M500-1>request logdb migrate lc serial-numberSlot: all Migration State: In Progress Percent Complete: 0.04 Estimated Time Remaining: 451 hour(s) 47 min(s)<ser_num>status
Recommended For You
Recommended Videos
Recommended videos not found.