topic Re: License and dynamic update query in Next-Generation Firewall Discussions

License and dynamic update query

vishalrsshah — Wed, 22 Jan 2025 15:34:07 GMT

Hi All,

I have panorama integrated Palo Alto devices and need help on below query

1) Can we perform dynamic update of Palo alto from devices itself instead of panorama. Does this practice unsync the Palo Alto from panorama ?

2) panorama having only management license but when I do check dynamic update it shows latest update. Should I move to update the same on panorama or does it update related to panorama or integrated Palo alto ?,

Re: License and dynamic update query

mshekh — Mon, 27 Jan 2025 03:40:38 GMT

Hi @vishalrsshah ,

Please refer the below response to your queries.

1) Can we perform dynamic update of Palo alto from devices itself instead of panorama. Does this practice unsync the Palo Alto from panorama ?

Response: Yes, you can perform dynamic update from device itself, No it will not unsync but it has to be same or lower version than panorama dynamic updates.

Response: Yes, you will get the latest update on Panorama and it's related to Panorama. recommended to schedule download and install periodically and ensure that Panorama dynamic update is same as firewalls or higher version then firewalls to avoid other issues like commit failure due to application miss match etc.

Additionally I didn't get your query related to integrated Palo Alto? What do you mean by integrated Palo Alto?

Re: License and dynamic update query

vishalrsshah — Mon, 27 Jan 2025 04:13:07 GMT

Nothing got my answer. Also can we do dynamic update for Palo Alto from panorama ?

Re: License and dynamic update query

mshekh — Mon, 27 Jan 2025 09:58:17 GMT

Hi @vishalrsshah ,

Yes, you can use device deployment option in Panorama to push the PAN-OS and content versions to connected devices.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/upgrade-firewalls-using-panorama