Prisma Access Release and Infrastructure Updates
Learn about the different types of Prisma
Access releases and updates that you need to stay up-to-date and
secure your users. Some of the updates are managed by Palo Alto
Networks, such as Prisma Access infrastructure updates and you will
receive advance notification so you can plan around them. Other
updates are your responsibility and you must schedule the specified
version of the content update, software update, and plugin version
(as required), at your earliest convenience.
You
can retrieve the status of all cloud services, including Prisma
Access and Cortex Data Lake, along with a historical record of the
uptime of each service, by accessing the https://status.paloaltonetworks.com/ website.
You can also sign up for email or text message updates at this site
to be notified in advance when infrastructure updates are planned
and real-time notifications when updates occur, and when Palo Alto
Networks creates, updates, or resolves an incident.
Prisma Access Upgrades
Prisma Access has upgrades, including
major (
x
.0 and 1.x
) and minor (2.1.x
) releases,
that include new features and optimizations to deliver best-of-breed
security for your remote networks and mobile users. The following
sections define the releases, list the types of upgrades that Palo
Alto Networks include for each release, and show you the advance
notification and maintenance windows for each release type.Release Definitions
The following list defines Prisma Access releases,
along with the advance notification we provide you for each release.
To make sure that you receive notifications for all releases, register
for email or text notifications for Prisma Access at the https://status.paloaltonetworks.com/ website.
- Scheduled Release—Prisma Access divides scheduled releases into major and minor releases.
- Major Release—A major release typically includes significant new features and optimizations that require a maintenance window.Notification—Palo Alto Networks provides you with a notification 21 days before a major release, including a feature preview document that lists features that are available with the release and any changes to default behavior.
- Minor Release—A minor release includes incremental features and optimizations. In some cases, Palo Alto Networks may combine a hotfix with a minor release.Notification—Palo Alto Networks provides you with a notification 10 days before a scheduled minor release upgrade, including a feature preview document that lists the new features that are available with the release.
Upgrade Types
Palo Alto Networks upgrades its cloud-based
infrastructure without any intervention required from you. Some
upgrades require that you perform an action, such as install a new
plugin.
The following list includes the different types of
Prisma Access upgrades:
- Infrastructure Upgrade—Palo Alto Networks upgrades the Prisma Access infrastructure, which includes the underlying service backend, orchestration, and monitoring infrastructure.
- Dataplane Upgrade—Palo Alto Networks upgrades the Prisma Access dataplane that enables traffic inspection and security policy enforcement on your network and user traffic.You use the Prisma Access Insights app to sign up for dataplane upgrade email alert notifications and indicate your upgrade preferences.
- Cloud Services Plugin Upgrade—Your network administrator will need to upgrade the Cloud Services plugin on the Panorama appliance that manages Prisma Access.
- Panorama Software Upgrade—A Prisma Access and Panorama Version Compatibility might be required to ensure compatibility with Prisma Access.
The
following table shows you what is included with each release, including
the maintenance window we provide and any impact to your Prisma
Access service.
Component | Update Schedule | Cloud Controlled? (Yes/No) | Comments |
|---|---|---|---|
Upgrades to Panorama software for compatibility with
Prisma Access | For major Prisma Access releases, you might
need to upgrade your Panorama version for the following use cases:
| No | See Prisma Access and Panorama Version Compatibility to learn when
a Panorama version becomes incompatible with Prisma Access. See Upgrade the Cloud Services Plugin for the
currently supported Panorama versions to use with Prisma Access.
To upgrade your Panorama to a new version, see Install Content and Software
Updates for Panorama. |
Cloud Services plugin version | Available after the plugin release. | No | You perform the tasks to upgrade the plugin.
See Prisma Access Upgrades for details about
when Prisma Access updates its plugin version. See Upgrade the Cloud Services Plugin to upgrade
the plugin in the Panorama appliance. |
GlobalProtect app |
| Yes | The cloud controls the versions of the app
that is available for upgrade; however you can choose between several
different hosted versions of the app and can control how and when
to roll out GlobalProtect app updates to the end users. See Manage Upgrade Options for the GlobalProtect App for details. If
your Prisma Access deployment requires a hotfix of the GlobalProtect app,
open a Support Case with Palo
Alto Networks Technical Support for assistance. |
Daily with a threshold of 24 hours. We
release New App-IDs on the third Tuesday of every month. Plan to
review and incorporate these new App-IDs within the 24 hour threshold. Use
the New App-ID filter to minimize
this possible traffic impact. | Yes | We will provide an update via the status.paloaltonetworks.com page 48 hours prior
to a cloud upgrade, and 24 hours prior to release of new App-ID
version. | |
Every hour, 10 minutes after the hour | Yes | Prisma Access is always up-to-date with the
latest Antivirus release. | |
Every hour | Yes | Prisma Access is always up-to-date with the
latest GlobalProtect data file release. | |
Clientless VPN application signatures | Every hour | Yes | Prisma Access is always up-to-date with the
latest Clientless VPN application signature release. |
Prisma Access and Panorama Version Compatibility
When Prisma Access upgrades its infrastructure
and dataplane after a major release, the upgrades can be incompatible
with earlier Panorama versions. Because of the fast-paced release
of Prisma Access and the Cloud Services plugin, the software compatibility
(end-of-support) dates for Panorama are shorter than the software
end-of-life dates for Panorama releases and apply to Panorama version
compatibility with Prisma Access only.
If the Panorama appliance
that manages Prisma Access is running a software version that is
incompatible (not supported) with the upgrades, you must upgrade
Panorama to a compatible version to take full advantage of the capabilities
of the infrastructure and dataplane upgrades. It is Palo Alto Networks’
goal to make this process as seamless as possible; for this reason,
we make every effort to provide you with adequate notice of Panorama
and Prisma Access version compatibility requirements.
To learn
when the software version of the Panorama that manages Prisma Access
is no longer compatible with Prisma Access, see End-of-Support (EoS) Dates for
Panorama Software Version Compatibility with Prisma Access in
the Palo Alto Networks Compatibility
Matrix. Before the end-of-support date, you should plan to
perform an upgrade to a supported Panorama version. For more information
about Prisma Access and Panorama software version compatibility,
see Prisma Access and Panorama Version
Compatibility.
To find the latest
EoS compatibility information for your Panorama with Prisma Access,
log in to the Panorama appliance that manages Prisma Access, select
the Service Setup page (), and view the
information in the
Panorama Alert
section. See Notifications and Alerts for Panorama, Cloud Services Plugin, and PAN-OS Dataplane Versions for details.The
Panorama upgrade is required, regardless of the Cloud Services plugin
version you are running at the end-of-support date. You cannot continue using
an earlier version of the Cloud Services plugin with an earlier,
unsupported Panorama version.
Cadence for Software and Content Updates for Prisma Access
The following table informs you of the software
and content updates that you must install to get the latest applications
and threat signatures and leverage the threat prevention capabilities
provided by Palo Alto Networks.
Component | Update Schedule | Cloud Controlled? (Yes/No) | Comments |
|---|---|---|---|
Upgrades to Panorama software for compatibility with
Prisma Access | For major Prisma Access releases, you might
need to upgrade your Panorama version for the following use cases:
| No | See Prisma Access and Panorama Version Compatibility to learn when
a Panorama version becomes incompatible with Prisma Access. See Upgrade the Cloud Services Plugin for the
currently supported Panorama versions to use with Prisma Access.
To upgrade your Panorama to a new version, see Install Content and Software
Updates for Panorama. |
Cloud Services plugin version | Available after the plugin release. | No | You perform the tasks to upgrade the plugin.
See Prisma Access Upgrades for details about
when Prisma Access updates its plugin version. See Upgrade the Cloud Services Plugin to upgrade
the plugin in the Panorama appliance. |
GlobalProtect app |
| Yes | The cloud controls the versions of the app
that is available for upgrade; however you can choose between several
different hosted versions of the app and can control how and when
to roll out GlobalProtect app updates to the end users. See Manage Upgrade Options for the GlobalProtect App for details. If
your Prisma Access deployment requires a hotfix of the GlobalProtect app,
open a Support Case with Palo
Alto Networks Technical Support for assistance. |
Daily with a threshold of 24 hours. We
release New App-IDs on the third Tuesday of every month. Plan to
review and incorporate these new App-IDs within the 24 hour threshold. Use
the New App-ID filter to minimize
this possible traffic impact. | Yes | We will provide an update via the status.paloaltonetworks.com page 48 hours prior
to a cloud upgrade, and 24 hours prior to release of new App-ID
version. | |
Every hour, 10 minutes after the hour | Yes | Prisma Access is always up-to-date with the
latest Antivirus release. | |
Every hour | Yes | Prisma Access is always up-to-date with the
latest GlobalProtect data file release. | |
Clientless VPN application signatures | Every hour | Yes | Prisma Access is always up-to-date with the
latest Clientless VPN application signature release. |
Upgrade Your Prisma Access Dataplane
Prisma Access performs dataplane upgrades
on the service to provide new security features and capabilities
to help protect your organization’s end-users, business assets,
and digital transformation. When a new version of Prisma Access
requires a dataplane upgrade, you need to understand how the upgrade
process works and have the required prerequisites in place before
upgrading. You can expect to receive scheduled upgrades every 8
to 12 weeks. The following sections provide an overview of the process,
along with what you need in order to have a successful upgrade.
Dataplane Upgrade Requirements
Before you start the upgrade process, make
sure that you have completed the following required actions:
- Go to the Prisma Access app and sign up for email notifications that keep you informed of when the dataplane upgrade will occur.In the email notifications, Palo Alto Networks will notify you of the two weekend dates when the upgrade process will occur. In addition, you will be requested to provide the first location to upgrade, along with the four-hour time window that Prisma Access will use to upgrade your locations. The time zone used for the window is the same as the time zone used for each location. For example, the US Southwest location uses the Pacific time zone for dataplane upgrades and the US Northeast location uses the Eastern time zone.
- Make sure that you have the following Prisma Access infrastructure requirements in place:
- Make sure that the Panorama that manages Prisma Access has the minimum required Panorama version for the Prisma Access version to which you want to upgrade.
- Use the API to retrieve all active and reserved public IP addresses for your Prisma Access deployment, and make sure that those IP addresses have been added to the allow lists in your network. When a mobile user location is upgraded, the reserved IP addresses become active and the active IP addresses become reserved.
Dataplane Upgrade Overview
Prisma Access upgrades your dataplane in two
phases on two weekend dates, and keeps you informed about the upgrade
using the Prisma Access app. On a high level, the following steps
are taken during the upgrade process.
- An email notification from the Prisma Access app arrives 21 days before the scheduled dataplane upgrade start date. This email notification provides the dataplane upgrade start date for phase #1.
- In the email, you are asked to select and submit the location or locations to upgrade first and the preferred time window for the upgrade via the Prisma Access App.You can change and submit the first locations to upgrade and time window multiple times for a given tenant. The last submission that occurred five days before the scheduled start date will be chosen by the service for the upgrade. You will not be able to make any changes within five days of the upgrade start date.If you make changes, it might take up to 30 minutes for the changes you made to be displayed in the Upgrade Dashboard on Insights. You will be notified via email alert when the Prisma Access has processed and completed the changes.Prisma Access strongly suggests that you select locations that reflect your entire deployment. For example, if you have a mobile user, service connection, and remote network deployment, select a location or locations that have all deployment types.
- Prisma Access will perform phase #1 of the upgrade on the selected location or locations within the local time window selected for those locations.
- If the selected upgrade locations have any combination of Mobile Users—GlobalProtect, Service Connections, or Remote Networks, the dataplane for each deployment will be upgraded to the required dataplane version, as described later in this section.
- Once the upgrade is complete in the first location, you’ll receive an email notification via the Prisma Access app. Palo Alto Networks recommends that you monitor the service for any new issues that occur immediately after the dataplane upgrade.
- In an unlikely occurrence where you see a new issue, report the issue to Palo Alto Networks technical support.The technical support team will investigate the issue and take corrective actions that may also include rolling back to the previous data plane version. This decision will be communicated to you via the technical support case.
- If there are no new issues or a new issue is not upgrade-related, Prisma Access will proceed with the dataplane upgrade on the following weekend.
- The upgrade of the remaining locations will take place during the same time window you selected for the first upgrade (in local time).
- After the dataplane upgrade completes, you will be notified via email alert.
The following figure shows the
timeline used for the upgrade and includes the tasks that you will
need to perform for the dataplane upgrade (shown in green), as well
as the steps that Prisma Access performs.
The
following section provides more details about the dataplane upgrade
process.
After you sign up for notifications,
Prisma Access informs you of the two weekend dates that will be
used for the upgrade process and sends these notifications 21 days,
3 days, and 24 hours before the first phase of the upgrade will
occur. The upgrade process occurs in two phases:
- Phase #1 upgrades the location or locations you chose on the first weekend using the time window you provided and notifies you via email when the upgrade is complete. If you did not choose the locations to upgrade first, or did not select a time window, Prisma Access makes the choices for you.Prisma Access attempts to upgrade the locations during the four-hour window that you select via the Prisma Access app. However, completing the required upgrades during this window is best-effort and Palo Alto Networks cannot guarantee that the locations will be upgraded during that time. If the locations cannot be upgraded within the specified time window, you will receive an email notification. Palo Alto Networks recommends that you schedule a change request window starting at 8 p.m. local time on Friday and ending at 8 p.m. local time on Sunday for each of the two weekends when the dataplane upgrade occurs.Prisma Access makes the following changes to your deployment during Phase #1 of the upgrade. See Dataplane Upgrade Example for more details.Deployment TypeWhat is UpgradedMobile User DeploymentsPrisma Access upgrades a single mobile user gateway, also known as theMobile User Security Processing Node (MU-SPN), for the location or locations you specify.Remote Network DeploymentsPrisma Access upgrades the backup (HA) remote network, also known as theRemote Network Security Processing Node (RN-SPN), then makes the backup remote network the active node for the location or locations you specify. The backup remote network is not upgraded. The backup remote network connection is not upgraded until the following weekend, when the active and backup nodes are upgraded for all locations.If there are multiple RN-SPNs in the selected location, all nodes are upgraded to the new dataplane version.Service ConnectionsPrisma Access upgrades the backup (HA) service connection, also known as the Service Connection Corporate Access Node (SC-CAN), then makes the backup service connection the active node for the location or locations you specify. The backup service connection is not upgraded until the following weekend, when the active and backup nodes are upgraded for all locations.If there are multiple SC-CANs in the selected location, all nodes are upgraded to the new dataplane version.Between the first and second upgrades, you should monitor the first upgraded locations and perform connectivity, performance, routing, and logging testing to make sure that the locations upgraded successfully. If you encounter a service-impacting failure after the upgrade, open a Support Case with Palo Alto Networks Technical Support for assistance. Palo Alto Networks will attempt to resolve the issue by rolling back the dataplane to a previous dataplane version within 24 hours.
- Seven days after Prisma Access upgrades the first location, Phase #2 upgrades the remainder of your locations, using the same time window you selected for the first phase, and notifies you via email when the upgrade is complete.The upgrade window can be longer. For example, if Phase #2 occurs during a national holiday in the United States of America, Prisma Access can perform the second phase of the upgrade 14 days after the first phase instead of seven. The notifications you receive in the Prisma Access app show you the specific timeline for the upcoming dataplane upgrade.
Dataplane Upgrade Example
The following example shows a sample dataplane
upgrade procedure for a Mobile Users deployment with five locations
(MU-SPNs) and three SC-CANs. The US West location has two MU-SPNs
as the result of an autoscale event (an extra MU-SPN was added after
a large number of mobile users logged in to that location).
In this
example, you selected a single location (US West) to upgrade first,
and requested a four-hour upgrade window of 8:00 a.m. to 12:00 noon Saturday
for the upgrade.
On the first upgrade weekend (Phase #1),
Prisma Access upgraded the dataplane for one of the MU-SPNs and
the SC-CAN in the US West location between 8:00 a.m. and 12:00 p.m.
Pacific Time on Saturday.
To determine the MU-SPN that
was upgraded, contact your authorized Palo Alto Networks representative
or partner.
Seven
days after the first location is upgraded, Prisma Access upgrades
the remaining components (Phase #2), including all the MU-SPNs and SC-CANs
in the deployment, using the same four-hour time window as was used
for the first phase of the upgrade (8:00 a.m. to 12:00 p.m. on Saturday).
In
this example, Prisma Access uses the following time zone information
when upgrading the dataplane:
- The remaining MU-SPN (MU-SPN 2) in the US West location is upgraded.
- The Japan Central MU-SPN and SC-CAN are upgraded using the local time in Japan.
- The UK MU-SPN and SC-CAN are upgraded using the local time in the UK.
- The US Southwest MU-SPN is upgraded using Pacific Time.
Use the Prisma Access App to Get Upgrade Alerts and Updates
To stay informed about the upgrade schedule
for your dataplane upgrade and to select your upgrade preferences,
you must use the Prisma Access app to subscribe to Prisma Access
notifications. Prisma Access uses email alerts to inform you of
the two weekend dates when your upgrade occurs; you select the location
or locations you want to upgrade first and the four-hour time window
to use for the upgrade.
After the upgrade starts, you can
also monitor the status of the upgrade using the Prisma Access app
as shown in the following steps.
- Sign up for alert notifications from the Prisma Access app.
- Grant access for the people whom you want to receive alert notifications.To receive alerts, you must be a Prisma Access admin. There are three types of admin roles, but only account administrators can grant users access to an app. Go to the hub to check role assignments and assign roles.
- Log in to Prisma Access from the hub.
- Select .
- + Add Usersand enter theUser Email Address(es), separated by commas, to which Prisma Access should send alert notifications.The email addresses to which Prisma Access sends alerts must be the same email addresses associated with users in your Palo Alto Networks support account.
- (Multi-Tenant Deployments Only) In a multi-tenant deployment,Select Sub-Tenantsfor which you want users to receive notifications orAll Sub-Tenantsif you want them to receive notifications from all sub-tenants.
- Addthe users.
- Check your notifications to be made aware of upcoming dataplane upgrades; then, select your upgrade preferences using one of the following methods.Prisma Access sends an upgrade notification 21 days before your dataplane upgrade is scheduled.
- Select .
- Log in to the Prisma Access app, view the banner at the top of the page for your scheduled upgrade, and selectClick here.
- Check your email for notifications for your scheduled upgrade and click the hyperlink in the email.
- Select .
The Prisma Access Upgrade Dashboard displays.
- (Optional) Read theUpgrade Processto learn more about how the upgrade process works.
- Select yourUpgrade Preferences.If you have a multi-tenant deployment, all tenants display in this area. If you have already selected your upgrade preferences for your deployment, these selections display here.
- Select the tenants for which to set upgrade preferences, then selectEdit Preferences.
- Select thePreferred Prisma Access Locationsthat you want to upgrade first.Prisma Access strongly suggests that you select locations that reflect your entire deployment. For example, if you have a mobile user, service connection, and remote network deployment, select a location or locations that have all deployment types.Select from the choices in the drop-down list.
- Prisma Access only displays the locations where you have deployed mobile users, remote networks, service connections, or any combination thereof.
- The groups in the drop-down list belong to the same compute location, with the exception of the locations in the following groups:
- Group 1: France North, France South, Ireland, United Kingdom
- Group 2: Japan Central, Japan South, South Korea
- If you select a choice in either Group 1 or Group 2, and if you have onboardings on two or more locations in that choice, Prisma Access might choose any of the locations in that group to upgrade. For example:
- If you select France North, France South, Ireland, United Kingdom as the choice for the upgrade, Prisma Access might choose any of the locations in Group 1 (for example, France South) to upgrade.
- If you select Japan Central, Japan South, South Korea as the choice for the upgrade, Prisma Access might choose any of the locations in Group 2 (for example, South Korea) to upgrade.
Prisma Access will inform you via email alerts which locations in the group were upgraded; any remaining locations will be upgraded with the remainder of the locations one week later.
After the first set of Prisma Access locations is upgraded successfully, the Prisma Access team monitors these locations for seven days, and then upgrades all remaining Prisma Access locations. Selecting a single location or a small number of locations gives you a chance to monitor these locations before the remainder of your locations are upgraded one week later.If no locations display in the drop-down list, you either selected multiple tenants that have no common locations deployed or you have not yet onboarded any locations for the tenants you selected. - Select thePreferred time for the upgrade windowfrom the list of available options.Choose from the following upgrade time windows. The time windows are local to the location or locations being upgraded and are all four hour windows:
- Friday 8:00 p.m. (noon) to 12:00 a.m. (midnight)
- Saturday 12:00 a.m. (midnight) to 4:00 a.m.
- Saturday 4:00 a.m. to 8:00 a.m.
- Saturday 8:00 a.m. to 12:00 p.m. (noon)
- Saturday 12:00 p.m. (noon) to 4:00 p.m.
- Saturday 4:00 p.m. (noon) to 8:00 p.m.
Palo Alto Networks uses your preference to begin the rollout at the Prisma Access location or locations you selected.The last submission that occurred five days before the scheduled start date will be chosen by the service for the upgrade. If you make changes, it might take up to 30 minutes for the changes you made to be displayed in the Upgrade Dashboard on Insights. You will be notified via email alert when the Prisma Access has processed and completed the changes.If you do not provide your upgrade preferences five days before the scheduled upgrade window, Palo Alto Networks will automatically select the first set of your deployed Prisma Access locations, notify you of the selection, and upgrade the selected locations on the scheduled date. The remaining Prisma Access locations, if any, in your deployment will be upgraded seven days after the selected time window.
- Select theSoftware Versionthat you want to upgrade to, if more than one version is available.
- Submityour changes.
- After your rollout begins, select and view theUpgrade Status by Location. This page displays the following information for each location that is being upgraded:
- The name of the tenant that is being upgraded.
- The start and finish date of the upgrade process.
- The dataplane version that the tenant is being upgraded to.
- The preferred time window for the upgrade.
- The initial locations that are being upgraded.
- The date that the remaining locations will be upgraded.
In addition, a table displays the locations being upgraded, the start date and time window of the upgrade, and the time zone used for the upgrade. TheUpgrade Statuscolumn provides you with the following information:Upgrade StatusDescriptionScheduledThe dataplane upgrade has been scheduled.StartedThe upgrade has started.In ProgressThe dataplane upgrade is in progress.Re-tryingThe dataplane upgrade did not complete successfully, but Prisma Access continues to be operational using the older dataplane version. Prisma Access will retry the upgrade before the maintenance window for the weekend expires.SuccessThe upgrade completed successfully. - After the first set of locations has completed the dataplane upgrade, monitor the upgraded locations and perform connectivity, performance, routing, and logging testing to make sure that they upgraded successfully.
- When the second set of locations is scheduled to be upgraded, monitor those locations and check their status by selecting .Prisma Access sends you an email notification after the dataplane upgrade is complete.
