Provides you with an overview of how to upgrade the Prisma
Access dataplane.
Prisma Access upgrades your dataplane in two phases
on two weekend dates, and keeps you informed about the upgrade using
the Prisma Access app. On a high level, the following steps are taken
during the upgrade process.
An email notification from the Prisma Access app arrives
21 days before the scheduled dataplane upgrade start date. This
email notification provides the dataplane upgrade start date for
phase #1.
In the email, you are asked to select and submit the location
or locations to upgrade first and the preferred time window for
the upgrade via the Prisma Access App.
You can change and
submit the first locations to upgrade and time window multiple times
for a given tenant. The last submission that occurred seven days
before the scheduled start date will be chosen by the service for
the upgrade. You will not be able to make any changes within seven days
of the upgrade start date.
If you make changes, it might
take up to 30 minutes for the changes you made to be displayed in
the Upgrade Dashboard on Insights. You will be notified via email
alert when the Prisma Access has processed and completed the changes.
Palo
Alto Networks strongly suggests that you select locations that reflect
your entire deployment. For example, if you have a mobile user,
service connection, and remote network deployment, select a location
or locations that have all deployment types.
Prisma Access will perform phase #1 of the upgrade on the
selected location or locations within the local time window selected
for those locations.
If the selected upgrade locations have any combination of Mobile
Users—GlobalProtect, Mobile Users—Explicit Proxy, Service Connections, or Remote
Networks, the dataplane for each deployment will be upgraded to the required
dataplane version, as described later in this section.
Once the upgrade is complete in the first location, you’ll
receive an email notification via the Prisma Access app. Palo Alto
Networks recommends that you monitor the service for any new issues
that occur immediately after the dataplane upgrade.
In an unlikely occurrence where you see a new issue, report
the issue to Palo Alto Networks technical support.
The technical
support team will investigate the issue and take corrective actions
that may also include rolling back to the previous dataplane version.
This decision will be communicated to you via the technical support
case.
If there are no new issues or a new issue is not upgrade-related,
Prisma Access will proceed with the dataplane upgrade on the following
weekend.
The upgrade of the remaining locations will take place during
the same time window you selected for the first upgrade (in local
time).
After the dataplane upgrade completes, you will be notified
via email alert.
The following figure shows the timeline used for the upgrade
and includes the tasks that you will need to perform for the dataplane
upgrade (shown in green), as well as the steps that Prisma Access performs.
The following section provides more details about the dataplane
upgrade process.
After you sign up for notifications,
Prisma Access informs you of the two weekend dates that will be
used for the upgrade process and sends these notifications 21 days,
3 days, and 24 hours before the first phase of the upgrade will
occur. The upgrade process occurs in two phases:
Phase #1 upgrades the location or locations you chose
on the first weekend using the time window you provided and notifies
you via email when the upgrade is complete. If you did not choose
the locations to upgrade first, or did not select a time window,
Prisma Access makes the choices for you.
Palo Alto Networks
attempts to upgrade the locations during the four-hour window that
you select via the Prisma Access app. However, completing the required
upgrades during this window is best-effort and Palo Alto Networks
cannot guarantee that the locations will be upgraded during that
time. If the locations cannot be upgraded within the specified time
window, you will receive an email notification. Palo Alto Networks
recommends that you schedule a change request window starting at
8 p.m. local time on Friday and ending at 8 p.m. local time on Sunday for
each of the two weekends when the dataplane upgrade occurs.
Prisma
Access makes the following changes to your deployment during Phase
#1 of the upgrade.
Deployment Type
What is Upgraded
Mobile User Deployments
Prisma Access upgrades a single mobile user gateway,
also known as the
Mobile User Security Processing Node (MU-SPN)
,
for the location or locations you specify.
Remote Network Deployments
Prisma Access upgrades the backup (HA) remote
network, also known as the
Remote Network Security Processing
Node (RN-SPN)
, then makes the backup remote network the active
node for the location or locations you specify. The backup remote network
connection is not upgraded until the following weekend, when the
active and backup nodes are upgraded for all locations.
If
there are multiple RN-SPNs in the selected location, all primary
nodes are upgraded to the new dataplane version.
Service Connections
Prisma Access upgrades the backup (HA) service
connection, also known as the Service Connection Corporate Access
Node (SC-CAN), then makes the backup service connection the active
node for the location or locations you specify. The backup service
connection is not upgraded until the following weekend, when the active
and backup nodes are upgraded for all locations.
If there
are multiple SC-CANs in the selected location, all backup nodes
are upgraded to the new dataplane version.
Between the first and second upgrades, monitor
the first upgraded locations and perform connectivity, performance,
routing, and logging testing to make sure that the locations upgraded successfully.
If you encounter a service-impacting failure after the upgrade,
open a Support Case with Palo
Alto Networks Technical Support for assistance. Palo Alto Networks
will attempt to resolve the issue by rolling back the dataplane
to a previous dataplane version within 24 hours.
Seven days after Prisma Access upgrades the first location,
Prisma Access upgrades the remainder of your locations (Phase #2
upgrade), using the same time window you selected for the first
phase, and notifies you via email when the upgrade is complete.
The
upgrade window can be longer. For example, if Phase #2 occurs during
a national holiday in the United States of America, the second phase
of the upgrade happens 14 days after the first phase instead of
seven. The notifications you receive in the Prisma Access app show you
the specific timeline for the upcoming dataplane upgrade.