Prisma Access Release and Infrastructure Updates

Learn about the different types of Prisma Access releases and updates that you need to stay up-to-date and secure your users. Some of the updates are managed by Palo Alto Networks, such as Prisma Access infrastructure updates and you will receive advance notification so you can plan around them. Other updates are your responsibility and you must schedule the specified version of the content update, software update, and plugin version (as required), at your earliest convenience.
You can retrieve the status of all cloud services, including Prisma Access and Cortex Data Lake, along with a historical record of the uptime of each service, by accessing the https://status.paloaltonetworks.com/ website. You can also sign up for email or text message updates at this site to be notified in advance when infrastructure updates are planned and real-time notifications when updates occur, and when Palo Alto Networks creates, updates, or resolves an incident.

Prisma Access Scheduled and Unscheduled Upgrades

Prisma Access has scheduled upgrades, including major (
x
.0 and 1.
x
) and minor (2.1.
x
) releases, that include new features and optimizations to deliver best-of-breed security for your remote networks and mobile users. Prisma Access might also need to occasionally make unscheduled upgrades for hotfixes and emergency bug fixes. The following sections define the releases, list the types of upgrades that Palo Alto Networks include for each release, and show you the advance notification and maintenance windows for each release type.

Release Definitions

The following list defines scheduled and unscheduled releases, along with the advance notification we provide you for each release. To make sure that you receive notifications for all releases, register for email or text notifications for Prisma Access at the https://status.paloaltonetworks.com/ website.
  • Scheduled Release
    —Prisma Access divides scheduled releases into major and minor releases.
    • Major Release
      —A major release typically includes significant new features and optimizations that require a maintenance window.
      Notification
      —Palo Alto Networks provides you with a notification 21 days before a major release, including a feature preview document that lists features that are available with the release and any changes to default behavior.
    • Minor Release
      —A minor release includes incremental features and optimizations. In some cases, Palo Alto Networks may combine a hotfix with a minor release.
      Notification
      —Palo Alto Networks provides you with a notification 10 days before a scheduled minor release upgrade, including a feature preview document that lists the new features that are available with the release.
  • Unscheduled Release
    —Unscheduled Prisma Access upgrades include hotfixes or emergency bug fixes (for example, fixes for zero-day threats or plugin changes).
    Notification
    —Palo Alto Networks will make every effort to give you 48 hours’ notice before an unscheduled upgrade. On occasion, you may receive a shorter notice for an unscheduled upgrade.

Upgrade Types

Palo Alto Networks upgrades its cloud-based infrastructure without any intervention required from you. Some upgrades require that you perform an action, such as install a new plugin.
The following list includes the different types of scheduled and unscheduled upgrades for Prisma Access:
  • Infrastructure Upgrade
    —Palo Alto Networks upgrades the Prisma Access infrastructure, which includes the underlying service backend, orchestration, and monitoring infrastructure.
  • Dataplane Upgrade
    —Palo Alto Networks upgrades the Prisma Access dataplane that enables traffic inspection and security policy enforcement on your network and user traffic.
    You use the Prisma Access Insights app to sign up for dataplane upgrade email alert notifications and indicate your upgrade preferences.
  • Cloud Services Plugin Upgrade
    —Your network administrator will need to upgrade the Cloud Services plugin on the Panorama appliance that manages Prisma Access.
  • Panorama Software Upgrade
    —A Prisma Access and Panorama Version Compatibility might be required to ensure compatibility with Prisma Access.
The following table shows you what is included with each release, including the maintenance window we provide and any impact to your Prisma Access service.
Upgrade Type
Scheduled Upgrades
Unscheduled Upgrades
Major
Minor
Infrastructure Upgrade
Maintenance Window
2-8 hours (always required)
2-8 hours (always required)
2-8 hours (if required)
Impact
: No impact to network traffic; however you cannot perform commits during the maintenance window.
Palo Alto Networks schedules the upgrades at a local time that is minimally disruptive to business functions.
Dataplane Upgrade
Maintenance Window
72 hours
(always required)
 —
(not required)
72 hours
(if required)
Impact
: Palo Alto Networks uses this window to upgrade the dataplane for all customers. You can make configuration changes and commits during this window. Our goal is to minimize impact to network traffic, but in some cases there may be a brief interruption.
You use the Prisma Access Insights app to sign up for dataplane upgrade email alert notifications and indicate your upgrade preferences, including the preferred time window for your upgrade.
Cloud Services Plugin Upgrade
Maintenance Window
(always required)
(if required)
(if required)
Impact
: Palo Alto Networks notifies you in advance if an upgrade to the Cloud Services plugin is required, and when the plugin will be available, using the notification schedule as defined in Release Definitions. During the plugin upgrade, you cannot make configuration changes and commits in Panorama.
After Palo Alto Networks provides you with the advance notification, you must plan to schedule a maintenance window to upgrade the plugin and complete the plugin upgrade within five days of its availability.
You cannot use the previous version of the plugin to perform changes to configuration and commits in Panorama after the three-day upgrade window.

Prisma Access and Panorama Version Compatibility

When Prisma Access upgrades its infrastructure and dataplane after a major release, the upgrades can be incompatible with earlier Panorama versions. Because of the fast-paced release of Prisma Access and the Cloud Services plugin, the software compatibility (end-of-support) dates for Panorama are shorter than the software end-of-life dates for Panorama releases and apply to Panorama version compatibility with Prisma Access only.
If the Panorama appliance that manages Prisma Access is running a software version that is incompatible (not supported) with the upgrades, you must upgrade Panorama to a compatible version to take full advantage of the capabilities of the infrastructure and dataplane upgrades. It is Palo Alto Networks’ goal to make this process as seamless as possible; for this reason, we make every effort to provide you with adequate notice of Panorama and Prisma Access version compatibility requirements.
Use the dates in the following table to learn when the software version of the Panorama that manages Prisma Access is no longer compatible with Prisma Access. Before the end-of-support date, you should plan to perform an upgrade to a supported Panorama version.
To find the latest EoS compatibility information for your Panorama with Prisma Access, log in to the Panorama appliance that manages Prisma Access, select the Service Setup page (
Panorama
Cloud Services
Configuration
Service Setup
), and view the information in the
Panorama Alert
section. See Notifications and Alerts for Panorama, Cloud Services Plugin, and PAN-OS Dataplane Versions for details.
Panorama Software Version
End-of-Support Dates for Prisma Access Deployments
9.1
February 1, 2022
Before this date, you must upgrade your Panorama to a version that is later than 9.1.x. Palo Alto Networks will update this document with more specific upgrade guidelines as newer Panorama software releases become generally available.
For more information about Prisma Access and Panorama software version compatibility, see Prisma Access and Panorama Version Compatibility in the Palo Alto Networks Compatibility Matrix.
The Panorama upgrade is required, regardless of the Cloud Services plugin version you are running at the end-of-support date. You cannot continue using an earlier version of the Cloud Services plugin with an earlier, unsupported Panorama version.

Cadence for Software and Content Updates for Prisma Access

The following table informs you of the software and content updates that you must install to get the latest applications and threat signatures and leverage the threat prevention capabilities provided by Palo Alto Networks.
Component
Update Schedule
Cloud Controlled? (Yes/No)
Comments
Upgrades to Panorama software for compatibility with Prisma Access
For major Prisma Access releases, you might need to upgrade your Panorama version for the following use cases:
  • Required Upgrade
    —On occasion, you will be required to upgrade the software version on Panorama Prisma Access and Panorama Version Compatibility with Prisma Access.
    • Maintenance Window
      —Your organization will need to schedule a maintenance window to upgrade the Panorama software version.
    • Impact
      —You cannot use the new plugin version until you upgrade your Panorama version.
    • Notification
      —Palo Alto Networks will provide you with a notification 100 days before the scheduled major release upgrade.
  • Optional Upgrade
    —In other cases, you might need to upgrade the Panorama software version to use the new features that Prisma Access supports in the major release.
    • Maintenance Window
      —Your organization will need to schedule a maintenance window to upgrade the Panorama software version.
    • Impact
      —You cannot use the new features that Prisma Access supports until you upgrade your Panorama.
    • Notification
      —Palo Alto Networks will notify you of any Panorama requirements 21 days before a scheduled major release upgrade as defined in Release Definitions.
No
See Prisma Access and Panorama Version Compatibility to learn when a Panorama version becomes incompatible with Prisma Access. See Upgrade the Cloud Services Plugin for the currently supported Panorama versions to use with Prisma Access. To upgrade your Panorama to a new version, see Install Content and Software Updates for Panorama.
Cloud Services plugin version
Available after the plugin release.
No
You perform the tasks to upgrade the plugin. See Prisma Access Scheduled and Unscheduled Upgrades for details about when Prisma Access updates its plugin version. See Upgrade the Cloud Services Plugin to upgrade the plugin in the Panorama appliance.
GlobalProtect app
  • Major GlobalProtect App Releases (for example,
    x
    .0 or 5.
    x
    )—
    Prisma Access updates the agent on the portal with the latest major release 7-10 days after the general availability of the
    x
    .0.1 version of that release.
    For example, given an agent release of 5.1, Prisma Access updates the agent on the portal 7-10 days after the release of 5.1.1.
  • Minor GlobalProtect App Releases (for example, 5.1.
    x
    )—
    Prisma Access updates the agent on the portal with the latest minor release 7-10 days after the general availability of that release.
Yes
The cloud controls the versions of the app that is available for upgrade; however you can choose between several different hosted versions of the app and can control how and when to roll out GlobalProtect app updates to the end users. See Manage Upgrade Options for the GlobalProtect App for details.
If your Prisma Access deployment requires a hotfix of the GlobalProtect app, open a Support Case with Palo Alto Networks Technical Support for assistance.
Daily with a threshold of 24 hours.
We release New App-IDs on the third Tuesday of every month. Plan to review and incorporate these new App-IDs within the 24 hour threshold. Use the New App-ID filter to minimize this possible traffic impact.
Yes
We will provide an update via the status.paloaltonetworks.com page 48 hours prior to a cloud upgrade, and 24 hours prior to release of new App-ID version.
Every hour, 10 minutes after the hour
Yes
Prisma Access is always up-to-date with the latest Antivirus release.
Every 5 minutes
Yes
Prisma Access is always up-to-date with the latest WildFire release.
Every hour
Yes
Prisma Access is always up-to-date with the latest GlobalProtect data file release.
Clientless VPN application signatures
Every hour
Yes
Prisma Access is always up-to-date with the latest Clientless VPN application signature release.

Upgrade Your Prisma Access Dataplane

Prisma Access performs dataplane upgrades on the service to provide new security features and capabilities to help protect your organization’s end-users, business assets, and digital transformation. When a new version of Prisma Access requires a dataplane upgrade, you need to understand how the upgrade process works and have the required prerequisites in place before upgrading. You can expect to receive scheduled upgrades every 8 to 12 weeks. The following sections provide an overview of the process, along with what you need in order to have a successful upgrade.

Dataplane Upgrade Requirements

Before you start the upgrade process, make sure that you have completed the following required actions:
  • Go to the Prisma Access app and sign up for email notifications that keep you informed of when the dataplane upgrade will occur.
    In the email notifications, Palo Alto Networks will notify you of the two weekend dates when the upgrade process will occur. In addition, you will be requested to provide the first location to upgrade, along with the four-hour time window that Prisma Access will use to upgrade your locations. The time zone used for the window is the same as the time zone used for each location. For example, the US Southwest location uses the Pacific time zone for dataplane upgrades and the US Northeast location uses the Eastern time zone.
  • Make sure that you have the following Prisma Access infrastructure requirements in place:

Dataplane Upgrade Overview

Prisma Access upgrades your dataplane in two phases on two weekend dates, and keeps you informed about the upgrade using the Prisma Access app. On a high level, the following steps are taken during the upgrade process.
  • An email notification from the Prisma Access app arrives 21 days before the scheduled dataplane upgrade start date. This email notification provides the dataplane upgrade start date for phase #1.
  • In the email, you are asked to select and submit the location or locations to upgrade first and the preferred time window for the upgrade via the Prisma Access App.
    You can change and submit the first locations to upgrade and time window multiple times for a given tenant. The last submission that occurred five days before the scheduled start date will be chosen by the service for the upgrade. You will not be able to make any changes within five days of the upgrade start date.
    If you make changes, it might take up to 30 minutes for the changes you made to be displayed in the Upgrade Dashboard on Insights. You will be notified via email alert when the Prisma Access has processed and completed the changes.
    Prisma Access strongly suggests that you select locations that reflect your entire deployment. For example, if you have a mobile user, service connection, and remote network deployment, select a location or locations that have all deployment types.
  • Prisma Access will perform phase #1 of the upgrade on the selected location or locations within the local time window selected for those locations.
  • If the selected upgrade locations have any combination of Mobile Users—GlobalProtect, Service Connections, or Remote Networks, the dataplane for each deployment will be upgraded to the required dataplane version, as described later in this section.
  • Once the upgrade is complete in the first location, you’ll receive an email notification via the Prisma Access app. Palo Alto Networks recommends that you monitor the service for any new issues that occur immediately after the dataplane upgrade.
  • In an unlikely occurrence where you see a new issue, report the issue to Palo Alto Networks technical support.
    The technical support team will investigate the issue and take corrective actions that may also include rolling back to the previous data plane version. This decision will be communicated to you via the technical support case.
  • If there are no new issues or a new issue is not upgrade-related, Prisma Access will proceed with the dataplane upgrade on the following weekend.
  • The upgrade of the remaining locations will take place during the same time window you selected for the first upgrade (in local time).
  • After the dataplane upgrade completes, you will be notified via email alert.
The following figure shows the timeline used for the upgrade and includes the tasks that you will need to perform for the dataplane upgrade (shown in green), as well as the steps that Prisma Access performs.
The following section provides more details about the dataplane upgrade process.
After you sign up for notifications, Prisma Access informs you of the two weekend dates that will be used for the upgrade process and sends these notifications 21 days, 3 days, and 24 hours before the first phase of the upgrade will occur. The upgrade process occurs in two phases:
  • Phase #1 upgrades the location or locations you chose on the first weekend using the time window you provided and notifies you via email when the upgrade is complete. If you did not choose the locations to upgrade first, or did not select a time window, Prisma Access makes the choices for you.
    Prisma Access attempts to upgrade the locations during the four-hour window that you select via the Prisma Access app. However, completing the required upgrades during this window is best-effort and Palo Alto Networks cannot guarantee that the locations will be upgraded during that time. If the locations cannot be upgraded within the specified time window, you will receive an email notification. Palo Alto Networks recommends that you schedule a change request window starting at 8 p.m. local time on Friday and ending at 8 p.m. local time on Sunday for each of the two weekends when the dataplane upgrade occurs.
    Prisma Access makes the following changes to your deployment during Phase #1 of the upgrade. See Dataplane Upgrade Example for more details.
    Deployment Type
    What is Upgraded
    Mobile User Deployments
    Prisma Access upgrades a single mobile user gateway, also known as the
    Mobile User Security Processing Node (MU-SPN)
    , for the location or locations you specify.
    Remote Network Deployments
    Prisma Access upgrades the backup (HA) remote network, also known as the
    Remote Network Security Processing Node (RN-SPN)
    , then makes the backup remote network the active node for the location or locations you specify. The backup remote network is not upgraded. The backup remote network connection is not upgraded until the following weekend, when the active and backup nodes are upgraded for all locations.
    If there are multiple RN-SPNs in the selected location, all nodes are upgraded to the new dataplane version.
    Service Connections
    Prisma Access upgrades the backup (HA) service connection, also known as the Service Connection Corporate Access Node (SC-CAN), then makes the backup service connection the active node for the location or locations you specify. The backup service connection is not upgraded until the following weekend, when the active and backup nodes are upgraded for all locations.
    If there are multiple SC-CANs in the selected location, all nodes are upgraded to the new dataplane version.
    Between the first and second upgrades, you should monitor the first upgraded locations and perform connectivity, performance, routing, and logging testing to make sure that the locations upgraded successfully. If you encounter a service-impacting failure after the upgrade, open a Support Case with Palo Alto Networks Technical Support for assistance. Palo Alto Networks will attempt to resolve the issue by rolling back the dataplane to a previous dataplane version within 24 hours.
  • Seven days after Prisma Access upgrades the first location, Phase #2 upgrades the remainder of your locations, using the same time window you selected for the first phase, and notifies you via email when the upgrade is complete.
    The upgrade window can be longer. For example, if Phase #2 occurs during a national holiday in the United States of America, Prisma Access can perform the second phase of the upgrade 14 days after the first phase instead of seven. The notifications you receive in the Prisma Access app show you the specific timeline for the upcoming dataplane upgrade.

Dataplane Upgrade Example

The following example shows a sample dataplane upgrade procedure for a Mobile Users deployment with five locations (MU-SPNs) and three SC-CANs. The US West location has two MU-SPNs as the result of an autoscale event (an extra MU-SPN was added after a large number of mobile users logged in to that location).
In this example, you selected a single location (US West) to upgrade first, and requested a four-hour upgrade window of 8:00 a.m. to 12:00 noon Saturday for the upgrade.
On the first upgrade weekend (Phase #1), Prisma Access upgraded the dataplane for one of the MU-SPNs and the SC-CAN in the US West location between 8:00 a.m. and 12:00 p.m. Pacific Time on Saturday.
To determine the MU-SPN that was upgraded, contact your authorized Palo Alto Networks representative or partner.
Seven days after the first location is upgraded, Prisma Access upgrades the remaining components (Phase #2), including all the MU-SPNs and SC-CANs in the deployment, using the same four-hour time window as was used for the first phase of the upgrade (8:00 a.m. to 12:00 p.m. on Saturday).
In this example, Prisma Access uses the following time zone information when upgrading the dataplane:
  • The remaining MU-SPN (MU-SPN 2) in the US West location is upgraded.
  • The Japan Central MU-SPN and SC-CAN are upgraded using the local time in Japan.
  • The UK MU-SPN and SC-CAN are upgraded using the local time in the UK.
  • The US Southwest MU-SPN is upgraded using Pacific Time.

Use the Prisma Access App to Get Upgrade Alerts and Updates

To stay informed about the upgrade schedule for your dataplane upgrade and to select your upgrade preferences, you must use the Prisma Access app to subscribe to Prisma Access notifications. Prisma Access uses email alerts to inform you of the two weekend dates when your upgrade occurs; you select the location or locations you want to upgrade first and the four-hour time window to use for the upgrade.
After the upgrade starts, you can also monitor the status of the upgrade using the Prisma Access app as shown in the following steps.
  1. Sign up for alert notifications from the Prisma Access app.
    1. Grant access for the people whom you want to receive alert notifications.
      To receive alerts, you must be a Prisma Access admin. There are three types of admin roles, but only account administrators can grant users access to an app. Go to the hub to check role assignments and assign roles.
    2. Log in to Prisma Access from the hub.
    3. Select
      Insights
      Alerts
      Alert Subscription
      .
    4. + Add Users
      and enter the
      User Email Address(es)
      , separated by commas, to which Prisma Access should send alert notifications.
      The email addresses to which Prisma Access sends alerts must be the same email addresses associated with users in your Palo Alto Networks support account.
    5. (
      Multi-Tenant Deployments Only
      ) In a multi-tenant deployment,
      Select Sub-Tenants
      for which you want users to receive notifications or
      All Sub-Tenants
      if you want them to receive notifications from all sub-tenants.
    6. Add
      the users.
  2. Check your notifications to be made aware of upcoming dataplane upgrades; then, select your upgrade preferences using one of the following methods.
    Prisma Access sends an upgrade notification 21 days before your dataplane upgrade is scheduled.
    • Select
      Insights
      Network Objects
      Prisma Access Upgrade
      Upgrade Preferences
      .
    • Log in to the Prisma Access app, view the banner at the top of the page for your scheduled upgrade, and select
      Click here
      .
    • Check your email for notifications for your scheduled upgrade and click the hyperlink in the email.
    • Select
      Insights
      Network Objects
      Prisma Access Upgrade
      Upgrade Preferences
      .
    The Prisma Access Upgrade Dashboard displays.
  3. (
    Optional
    ) Read the
    Upgrade Process
    to learn more about how the upgrade process works.
  4. Select your
    Upgrade Preferences
    .
    If you have a multi-tenant deployment, all tenants display in this area. If you have already selected your upgrade preferences for your deployment, these selections display here.
    1. Select the tenants for which to set upgrade preferences, then select
      Edit Preferences
      .
    2. Select the
      Preferred Prisma Access Locations
      that you want to upgrade first.
      Prisma Access strongly suggests that you select locations that reflect your entire deployment. For example, if you have a mobile user, service connection, and remote network deployment, select a location or locations that have all deployment types.
      Select from the choices in the drop-down list.
      • Prisma Access only displays the locations where you have deployed mobile users, remote networks, service connections, or any combination thereof.
      • The groups in the drop-down list belong to the same compute location, with the exception of the locations in the following groups:
        • Group 1
          : France North, France South, Ireland, United Kingdom
        • Group 2
          : Japan Central, Japan South, South Korea
      • If you select a choice in either Group 1 or Group 2, and if you have onboardings on two or more locations in that choice, Prisma Access might choose any of the locations in that group to upgrade. For example:
        • If you select France North, France South, Ireland, United Kingdom as the choice for the upgrade, Prisma Access might choose any of the locations in Group 1 (for example, France South) to upgrade.
        • If you select Japan Central, Japan South, South Korea as the choice for the upgrade, Prisma Access might choose any of the locations in Group 2 (for example, South Korea) to upgrade.
        Prisma Access will inform you via email alerts which locations in the group were upgraded; any remaining locations will be upgraded with the remainder of the locations one week later.
      After the first set of Prisma Access locations is upgraded successfully, the Prisma Access team monitors these locations for seven days, and then upgrades all remaining Prisma Access locations. Selecting a single location or a small number of locations gives you a chance to monitor these locations before the remainder of your locations are upgraded one week later.
      If no locations display in the drop-down list, you either selected multiple tenants that have no common locations deployed or you have not yet onboarded any locations for the tenants you selected.
    3. Select the
      Preferred time for the upgrade window
      from the list of available options.
      Choose from the following upgrade time windows. The time windows are local to the location or locations being upgraded and are all four hour windows:
      • Friday 8:00 p.m. (noon) to 12:00 a.m. (midnight)
      • Saturday 12:00 a.m. (midnight) to 4:00 a.m.
      • Saturday 4:00 a.m. to 8:00 a.m.
      • Saturday 8:00 a.m. to 12:00 p.m. (noon)
      • Saturday 12:00 p.m. (noon) to 4:00 p.m.
      • Saturday 4:00 p.m. (noon) to 8:00 p.m.
      Palo Alto Networks uses your preference to begin the rollout at the Prisma Access location or locations you selected.The last submission that occurred five days before the scheduled start date will be chosen by the service for the upgrade. If you make changes, it might take up to 30 minutes for the changes you made to be displayed in the Upgrade Dashboard on Insights. You will be notified via email alert when the Prisma Access has processed and completed the changes.
      If you do not provide your upgrade preferences five days before the scheduled upgrade window, Palo Alto Networks will automatically select the first set of your deployed Prisma Access locations, notify you of the selection, and upgrade the selected locations on the scheduled date. The remaining Prisma Access locations, if any, in your deployment will be upgraded seven days after the selected time window.
    4. Select the
      Software Version
      that you want to upgrade to, if more than one version is available.
    5. Submit
      your changes.
  5. After your rollout begins, select
    Insights
    Network Objects
    Prisma Access Upgrade
    Upgrade Status by Tenants
    and view the
    Upgrade Status by Location
    . This page displays the following information for each location that is being upgraded:
    • The name of the tenant that is being upgraded.
    • The start and finish date of the upgrade process.
    • The dataplane version that the tenant is being upgraded to.
    • The preferred time window for the upgrade.
    • The initial locations that are being upgraded.
    • The date that the remaining locations will be upgraded.
    In addition, a table displays the locations being upgraded, the start date and time window of the upgrade, and the time zone used for the upgrade. The
    Upgrade Status
    column provides you with the following information:
    Upgrade Status
    Description
    Scheduled
    The dataplane upgrade has been scheduled.
    Started
    The upgrade has started.
    In Progress
    The dataplane upgrade is in progress.
    Re-trying
    The dataplane upgrade did not complete successfully, but Prisma Access continues to be operational using the older dataplane version. Prisma Access will retry the upgrade before the maintenance window for the weekend expires.
    Success
    The upgrade completed successfully.
  6. After the first set of locations has completed the dataplane upgrade, monitor the upgraded locations and perform connectivity, performance, routing, and logging testing to make sure that they upgraded successfully.
  7. When the second set of locations is scheduled to be upgraded, monitor those locations and check their status by selecting
    Insights
    Network Objects
    Prisma Access Upgrade
    Upgrade Status by Tenants
    .
    Prisma Access sends you an email notification after the dataplane upgrade is complete.

Recommended For You