Upgrade the PAN-OS Software Version Using Panorama

Follow these steps to upgrade your Panorama-managed firewalls to PAN-OS 9.0 XFR.
Use the following procedure to upgrade firewalls that you manage with Panorama. This procedure applies to standalone firewalls and firewalls deployed in a high availability (HA) configuration.
Before upgrading to an XFR release, you must first upgrade to the corresponding standard PAN-OS release. For example, to upgrade to PAN-OS 9.0.3 XFR, you must first upgrade your firewalls to PAN-OS 9.0.3.
If Panorama is unable to connect directly to the update server, follow the procedure for deploying updates to firewalls when Panorama is not internet-connected so that you can manually download images to Panorama and then distribute the images to firewalls.
Before you can upgrade firewalls from Panorama, you must:
  • Make sure Panorama is running the same or a later PAN-OS version than you are upgrading to. You must upgrade Panorama and its Log Collectors to 9.0 before upgrading the managed firewalls to this version. In addition, when upgrading Log Collectors to 9.0, you must upgrade all Log Collectors at the same time due to changes in the logging infrastructure.
  • Plan for an extended maintenance window of up to six hours when upgrading Panorama to 9.0. This release includes significant infrastructure changes, which means that the Panorama upgrade will take longer than in previous releases.
  • Ensure that firewalls are connected to a reliable power source. A loss of power during an upgrade can make a firewall unusable.
  1. After upgrading Panorama, commit and push the configuration to the firewalls you are planning to upgrade.
    The PAN-OS 9.0 release introduces universally unique identifiers (UUIDs) for policy rules. If you manage firewall policy from Panorama, these UUIDs are generated on Panorama and therefore must be pushed from Panorama. If you do not push the configuration from Panorama prior to upgrading the firewalls, the firewall upgrade will not succeed because it will not have the UUIDs.
  2. Verify that enough hardware resources are available to the VM-Series firewall.
    Refer to the VM-Series System Requirements to see the resource requirements for each VM-Series model. Allocate additional hardware resources before continuing the upgrade process; the process for assigning additional hardware resources differs on each hypervisor.
    If the VM-Series firewall does not have the required resources for the model, it defaults to the capacity associated with the VM-50.
  3. From the web interface, navigate to
    Device
    Licenses
    and make sure you have the correct VM-Series firewall license and that the license is activated.
    On the VM-Series firewall standalone version, navigate to
    Device
    Support
    and make sure that you have activated the support license.
  4. Save a backup of the current configuration file on each managed firewall you plan to upgrade.
    Although the firewall automatically creates a configuration backup, it is a best practice to create and externally store a backup before you upgrade.
    1. From the Panorama web interface, select
      Panorama
      Setup
      Operations
      and click
      Export Panorama and devices config bundle
      to generate and export the latest configuration backup of Panorama and of each managed appliance.
    2. Save the exported file to a location external to the firewall. You can use this backup to restore the configuration if you have problems with the upgrade.
  5. Update the content release version on the firewalls you plan to upgrade.
    Refer to the Release Notes for the minimum content release version required for PAN-OS 9.0. Make sure to follow the Best Practices for Application and Threat Updates when deploying content updates to Panorama and managed firewalls.
    1. Select
      Panorama
      Device Deployment
      Dynamic Updates
      and
      Check Now
      for the latest updates. If an update is available, the Action column displays a
      Download
      link.
    2. If not already installed,
      Download
      the latest content release version.
    3. Click
      Install
      , select the firewalls on which you want to install the update, and click
      OK
      . If you are upgrading HA firewalls, you must update content on both peers.
  6. (HA firewall upgrades only)
    If you will be upgrading firewalls that are part of an HA pair, disable preemption. You need only disable this setting on one firewall in each HA pair.
    1. Select
      Device
      High Availability
      and edit the
      Election Settings
      .
    2. If enabled, disable (clear) the
      Preemptive
      setting and click
      OK
      .
    3. Commit
      your change. Make sure the commit is successful before you proceed with the upgrade.
  7. Download the target PAN-OS release image.
    1. Select
      Panorama
      Device Deployment
      Software
      and
      Check Now
      for the latest release versions.
    2. Download
      the firewall-specific file (or files) for the release version to which you are upgrading. You must download a separate installation file for each firewall model (or firewall series) that you intend to upgrade.
  8. Install the PAN-OS software update on the firewalls.
    1. Click
      Install
      in the Action column that corresponds to the firewall models you want to upgrade.
    2. In the Deploy Software file dialog, select all firewalls that you want to upgrade. To reduce downtime, select only one peer in each HA pair. For active/passive pairs, select the passive peer; for active/active pairs, select the active-secondary peer.
    3. (HA firewall upgrades only)
      Make sure
      Group HA Peers
      is not selected.
    4. Select
      Reboot device after install
      .
    5. To begin the upgrade, click
      OK
      .
    6. After the installation completes successfully, reboot using one of the following methods:
      • If you are prompted to reboot, click
        Yes
        .
      • If you are not prompted to reboot, select
        Device
        Setup
        Operations
        and
        Reboot Device
        .
    7. After the firewalls finish rebooting, select
      Panorama
      Managed Devices
      and verify the Software Version is 9.0.0 for the firewalls you upgraded. Also verify that the HA status of any passive firewalls you upgraded is still passive.
  9. (HA firewall upgrades only)
    Upgrade the second HA peer in each HA pair.
    1. (Active/passive upgrades only)
      Suspend the active device in each active/passive pair you are upgrading.
      1. Switch context to the active firewall.
      2. In the High Availability widget on the
        Dashboard
        , verify that
        Local
        firewall state is
        Active
        and the
        Peer
        is
        Passive
        ).
      3. Select
        Device
        High Availability
        Operational Commands
        Suspend local device
        .
      4. Go back to the High Availability widget on the
        Dashboard
        and verify that
        Local
        changed to
        Passive
        and
        Peer
        changed to
        Active
        .
    2. Go back to the Panorama context and select
      Panorama
      Device Deployment
      Software
      .
    3. Click
      Install
      in the Action column that corresponds to the firewall models of the HA pairs you are upgrading.
    4. In the Deploy Software file dialog, select all firewalls that you want to upgrade. This time, select only the peers of the HA firewalls you just upgraded.
    5. Make sure
      Group HA Peers
      is not selected.
    6. Select
      Reboot device after install
      .
    7. To begin the upgrade, click
      OK
      .
    8. After the installation completes successfully, reboot using one of the following methods:
      • If you are prompted to reboot, click
        Yes
        .
      • If you are not prompted to reboot, select
        Device
        Setup
        Operations
        and
        Reboot Device
        .
    9. (Active/passive upgrades only)
      From the CLI of the peer you just upgraded, run the following command to make the firewall functional again:
      request high-availability state functional
  10. (
    PAN-OS XFR upgrade only
    ) Upgrade the first peer and second peer to PAN-OS XFR by repeating Step 8 and Step 9.
  11. Verify the software and content release version running on each managed firewall.
    1. On Panorama, select
      Panorama
      Managed Devices
      .
    2. Locate the firewalls and review the content and software versions in the table.
      For HA firewalls, you can also verify that the HA Status of each peer is as expected.
      If your HA firewalls have local policy rules configured, upon upgrade to PAN-OS 9.0, each peer independently assigns UUIDs for each rule. Because of this, the peers will show as out of sync until you sync the configuration (
      Dashboard
      Widgets
      System
      High Availability
      Sync to peer
      ).
  12. (HA firewall upgrades only)
    If you disabled preemption on one of your HA firewalls before you upgraded, then edit the
    Election Settings
    (
    Device
    High Availability
    ) and re-enable the
    Preemptive
    setting for that firewall and then
    Commit
    the change.

Related Documentation