topic Pan OS upgrade in HA pair 10.0.9 to 10.2.3 in Next-Generation Firewall Discussions

Pan OS upgrade in HA pair 10.0.9 to 10.2.3

MPappachan — Fri, 26 May 2023 17:36:00 GMT

I have vm series in ha pair managed by the panorama(10.2.3). When I look the upgrade path it appears

10.0.9 ->10.0.11-h1 -> 10.1.0 ->10.1.10->10.2.0 -> 10.2.3. I have confusion on fail over, do I need to fail over on each version?

Thank you.

Re: Pan OS upgrade in HA pair 10.0.9 to 10.2.3

Raido_Rattameister — Fri, 26 May 2023 18:28:55 GMT

Yes you need to fail over every time.

Upgrade passive, reboot.

Upgrade active, reboot.

repeat...

Although I like path you suggested and I follow it myself there is a way to save time if you are in a rush.

Starting point 10.0.9

Download and install 10.0.11-h1

Download 10.1.0

Download and install 10.1.10

Download 10.2.0

Download and install 10.2.4 (10.2.3 unless you can upgrade Panorama before).

10.2.4 is currently preferred release.

One thing to keep in mind is that virtual Palos use hypervisor assigned mac addresses not virtual floating mac.

This means that mac addresses change during failover.

If you have devices that don't accept gratuitous arp then you need to clear their arp table.

Good example is other Palo firewalls themselves that don't update their arp table if gratuitous arp is received.

Re: Pan OS upgrade in HA pair 10.0.9 to 10.2.3

MPappachan — Fri, 26 May 2023 19:59:23 GMT

Thank you for your detailed responses. One more clarification, are you skipping the steps for 'Disable preemptive, request high-availability state suspend and request high-availability functional state? for each fail over or is that included?

Thanks again.

Re: Pan OS upgrade in HA pair 10.0.9 to 10.2.3

Raido_Rattameister — Fri, 26 May 2023 20:11:09 GMT

Yes I skip manual failover.

After passive is upgraded/rebooted I upgrade and reboot active and let firewalls to perform HA automatically.
When active goes to reboot then passive will become automatically active.

As I often upgrade remote firewalls I don't like to place any firewall into suspend state.

I also have preemt enabled so when primary firewall returns from reboot it will take active role back automatically as well.