Install Updates for Panorama with an Internet Connection

1. Verify that the updates you plan to install are appropriate for your Panorama deployment.
   Palo Alto Networks highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version.

   • Refer to the Release Notes for the minimum content release version required for a Panorama software release. If you intend to upgrade Log Collectors and firewalls to a particular release, you must first upgrade Panorama to that (or a later) release.
   • For a Panorama virtual appliance that runs on a hypervisor, ensure that the instance meets the Setup Prerequisites for the Panorama Virtual Appliance.
2. Determine the Upgrade Path to PAN-OS 9.1.
   You cannot skip the installation of any feature release versions in the path from the currently running PAN-OS version to PAN-OS 9.1. Review the known issues and changes to default behavior in the Release Notes and upgrade/downgrade considerations in the New Features Guide for each release through which you pass as part of your upgrade path.
3. (Panorama Interconnect plugin only) Synchronize the Panorama Node with the Panorama Controller.
   Before you begin upgrading a Panorama Node, you must synchronize the Panorama Controller and Panorama Node configuration. This is required to successfully push the common Panorama Controller configuration to your Panorama Node after successful upgrade.
4. Save a backup of the current Panorama configuration file that you can use to restore the configuration if you have problems with the upgrade.
   Although Panorama automatically creates a backup of the configuration, best practice is to create and externally store a backup before you upgrade.
   1. Log in to the Panorama Web Interface.
   2. Save named Panorama configuration snapshot (PanoramaSetupOperations), enter a Name for the configuration, and click OK.
   3. Export named Panorama configuration snapshot, select the Name of the configuration you just saved, click OK, and save the exported file to a location that is external to Panorama.
5. Install the latest content updates.
   If Panorama is not running the minimum content versions required for the Panorama release to which you intend to upgrade, you must update content versions to the minimum (or later) versions before you install the software updates. Refer to Release Notes for minimum content release version for a Panorama release.

   Palo Alto Networks® highly recommends that Panorama, Log Collectors, and all managed firewalls run the same content release version. Additionally, we recommend that you schedule automatic, recurring updates so that you are always running the latest content versions (refer to 9).
   1. Select PanoramaDynamic Updates and Check Now for the latest updates. If an update is available, the Action column displays a Download link.
      Ensure that Panorama is running the same but not a later content release version than is running on managed firewalls and Log Collectors.
   2. Before you update the content release version on Panorama, be sure to upgrade managed firewalls and then Log Collectors (see Upgrade Log Collectors When Panorama Is Internet-Connected) to the same (or a later) content release version.
      If you do not need to install content updates at this time, then skip ahead to the next step.
   3. Install remaining content updates, as needed. When installed, the Currently Installed column displays a check mark.
      1. Download and Install the Applications or Applications and Threats update. Regardless of your subscription, Panorama installs and needs only the Applications content update, not the Threats content. For details, see Panorama, Log Collector, Firewall, and WildFire Version Compatibility.
      2. Download and Install other updates (Antivirus, WildFire®, or URL Filtering) as needed, one at a time, and in any sequence.
6. Upgrade Panorama to the PAN-OS releases along your upgrade path to PAN-OS 9.1.
   1. Install Updates for Panorama with an Internet Connection to PAN-OS 8.1.
   2. Install Updates for Panorama with an Internet Connection to PAN-OS 9.0.
      PAN-OS 9.0 introduced a new log format. If a local Log Collector is configured, logs are automatically migrated to the new format after you successfully upgrade Panorama to PAN-OS 9.0.

      Do not continue on your upgrade path until you verify the automatic log migration completed successfully.
7. Upgrade Panorama to PAN-OS 9.1.
   1. Check Now (PanoramaSoftware) for the latest releases. If a software release is available, the Action column displays Download.
   2. Locate and Download the PAN-OS 9.1.0 image. After a successful download, the Action column changes from Download to Install for the downloaded image.
   3. Install the downloaded image and then reboot.
      1. Install the image.
      2. After the installation completes successfully, reboot using one of the following methods:
         • If prompted to reboot, click Yes. If you see a CMS Login prompt, press Enter without typing a username or password. When the Panorama login prompt appears, enter the username and password you specified during initial configuration.
         • If you are not prompted to reboot, Reboot Panorama from the Device Operations section (PanoramaSetupOperations).
   4. (Required only if upgrading to PAN-OS 9.1.1 or a later release) After you complete the above steps for the PAN-OS 9.1 base image, repeat steps 1 through 3 to upgrade to the target maintenance release.
8. (If local Log Collector is in a Collector Group) Upgrade the remaining Log Collectors in the Collector Group.
   • Upgrade Log Collectors When Panorama Is Internet-Connected
   • Upgrade Log Collectors When Panorama Is Not Internet-Connected
9. (Best Practice) Schedule recurring, automatic content updates.
   Panorama does not synchronize content update schedules across HA peers. You must perform this task on both the active and passive Panorama.

   In the header row for each update type (PanoramaDynamic Updates), the Schedule is initially set to None. Perform the following steps for each update type.
   1. Click None and select the update frequency (Recurrence). The frequency options depend on the update type.
   2. Select the schedule action:
      • Download And Install (Best Practice)—Panorama automatically installs updates after downloading them.
      • Download Only—You must manually install updates after Panorama downloads them.
   3. Based on the best practices for the security posture of your organization, configure a delay (Threshold) after an update becomes available before Panorama downloads the update.
   4. Click OK to save your changes.
   5. Select CommitCommit to Panorama and Commit your changes.