>
    Strata Copilot
    Upgrade ZTNA Connectors
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access
    3. Prisma Access Administration
    4. Prisma Access ZTNA Connector
    5. Configure ZTNA Connector
    6. Upgrade ZTNA Connectors
    Download PDF
    Prisma Access

    Upgrade ZTNA Connectors

    Table of Contents

    Upgrade ZTNA Connectors

    How to upgrade the software version of ZTNA connectors.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Strata Cloud Manager)
    • Prisma Access (Managed by Panorama)
    • We require a minimum version of Prisma Access 5.0 to enable ZTNA Connector support.
    • Prisma Access license includes 10 connectors, 20,000 FQDNs, and 1024 IP subnets. This functionality is provided for the purpose of trying out ZTNA Connectors in your environment.
    • The Private App add-on license includes 200 ZTNA Connectors, 20,000 FQDNs, and 1024 IP subnet functionality.
    To keep the ZTNA Connectors up-to-date, you can update their software version. You also might be required to upgrade your connectors to support a new feature or functionality.
    When a new ZTNA Connector version is released, the connectors in your deployment are checked and, if the released version is newer than the existing version, or if all connectors in the group are not on the same version, icons in the Connector Group area shows that an update is available. If you choose to update the connectors, you are given an option to upgrade the entire group together. Upgrading a group automatically upgrades all connectors in that group in parallel. You cannot upgrade individual connectors.
    A ZTNA Connector takes approximately 8 to 10 minutes to upgrade and the connector is rebooted during this process. After an upgrade starts, you can't cancel it. Palo Alto Networks recommends that you schedule a connector upgrade during a down time or a scheduled network outage.
    1. Go to ZTNA ConnectorConnector Groups. Green arrows indicate that an upgrade is available.
      You can only upgrade to the latest image version that is available for the tenant.
    2. Click the green arrow next to the Connector Group.
    3. Select Install Now to upgrade the connector group now, or Schedule and provide a time and date for the upgrade. The time displayed is the local time zone for the admin using the ZTNA UI.
      You can Cancel Scheduled Upgrade up to five minutes before it begins.
    4. (Optional) To upgrade the Connector Group serially, you can use a rolling upgrade.
      During a rolling upgrade, Prisma Access upgrades each Connector in a Connector Group individually rather than simultaneously. When the upgrade begins, ZTNA Connector is put in a quiesce mode accepting no new sessions. Then Prisma Access drains the Connector, which prevents it from accepting new sessions. To maintain continuous application access, Prisma Access forwards new client sessions to the remaining Connectors in the Connector Group. When the Connector has no active sessions or the drain timeout is reached, the Connector is then upgraded. When the Connector upgrade is completed, the same sequence of steps is applied to the next Connector until the Connector Group rolling upgrade is completed.
      Select Install Now to upgrade the connector group now, or Schedule and provide a time and date for the upgrade. The time displayed is the local time zone for the admin using the ZTNA UI.
      Select Rolling Upgrade, select Maximum Connector Drain Timeout, and select Create.
      The maximum connector drain timeout unit is in minutes, and the maximum drain timeout is 60 minutes.
      The Maximum Connector Drain Timeout defines the grace period allowed for active sessions to close naturally before an upgrade begins.
      Once a connector enters the Draining state, it stops accepting new traffic. The system then waits for existing connections to terminate.
      If the timeout is reached and active connections still persist, the system will forcefully terminate the remaining sessions to ensure the upgrade proceeds as scheduled. This prevents a single long-lived connection from indefinitely stalling the maintenance window.
      Select Monitoring to see the status of your upgrade.
    5. Check the status of the connectors by viewing the icon under Connector Version.
      IconDescription
      		Upgrade is available.
      		Upgrade is scheduled.
      		Upgrade has started and is in progress.
      No Icon (Only Connector version is displayed)
      		Upgrade was successful.
      		Not all of the connectors were upgraded.
      		Upgrade failed.

    © 2026 Palo Alto Networks, Inc. All rights reserved.