FW HA Version Update

[manuellara]

Good afternoon team:
Could you support me on how is the HA version upgrade process?
First the passive fw? then the active one?

Greetings.

#paloaltoHA #update

[PavelK · Accepted solution]

Hello @manuellara

here is the official documentation: Upgrade an HA Firewall Pair. The official documentation recommends for active/passive firewalls to suspend (fail over) and upgrade the active (primary) peer first, then failback and continue the upgrade with the other firewall, however based on my past experience it is ok to start with passive firewall first.

Kind Regards

Pavel 

[KWIlson01]

Hey Pavel,
I've done upgrades on HA firewall device groups for a long while. I've always done the passive-firewall upgrade first, then F/O and upgrade the other peer. Is the initial F/O (before upgrade) done to test HA function before upgrading? (Of course I could be misremembering old procedures.)

[BPry]

@KWIlson01,

It's my understanding that this is the intent of the official documentation. In the event that this doesn't work for some reason you have a known good unit to restore traffic that hasn't been modified at all. 

In the event that you upgrade the passive firewall and failover and encounter an issue, you've introduced two variables at the same time. It could either be that the passive firewall couldn't handle traffic appropriately to begin with, or it could be the new code causing an issue.

Personally I recommend testing failover at least once a month to validate that everything is functional, and with that I personally always do passive/secondary upgrade first and then move on to the active/primary unit. If you know that failover is actually going to function, the initial failover is just (to me) adding an unnecessary step. 

[KWIlson01]

@BPry ,
Appreciate the detail, and thoughts on the procedure. Very good points for best practice.