topic Re: Using Panorama to change controlled firewalls Active/Passive in Panorama Discussions

Using Panorama to change controlled firewalls Active/Passive

J_Healy — Wed, 18 Jun 2025 13:35:51 GMT

I am upgrading all my controlled firewalls using Panorama. I am able to upload, install, and reboot my passive firewalls. But now I need to switch my active/passive firewalls. Is there a way to do this in Panorama? Before I would manually login (GUI or CLI) to each active firewall and use the suspend function to force fail-over.

If there is a way to do this or something similar in Panorama, please let me know. Thank you.

Re: Using Panorama to change controlled firewalls Active/Passive

PavelK — Thu, 19 Jun 2025 01:01:13 GMT

Hello @J_Healy

thanks for posting.

To my knowledge there is no way to trigger Firewall failover directly from Panorama. I think the technical reason for this is Panorama is primarily designed for central configuration and log management and not direct real time operations.

In the past when I was doing Firewall upgrades, I had exactly the same question as you. Having Firewall failover capability directly from Panorama was feature I was missing. I eventually limited Panorama triggered upgrades only for stand alone Firewalls. HA pairs, I used to upgrade directly from Firewalls.

Kind Regards

Pavel

Re: Using Panorama to change controlled firewalls Active/Passive

TomYoung — Thu, 19 Jun 2025 16:44:11 GMT

Hi @J_Healy ,

Like you I use Panorama to upgrade my NGFWs because it saves me from having to download and install on each one. I still log in to each one to suspend and make functional because I make sure the standby is in a passive state before I fail over. In the long run, it would be good for Panorama to do it all with one click.

Upgrade HA Pair button:

Upgrade passive.
Wait and verify passive is ready for failover.
Suspend active and upgrade.
Verify all HA checks passed.

You could even have it make the original one active again.

It is interesting that you can suspend the NGFW with SCM.

Thanks,

Tom

Re: Using Panorama to change controlled firewalls Active/Passive

J_Healy — Thu, 19 Jun 2025 20:03:42 GMT

Thank you @PavelK. I was afraid you were going to say that. 🙂

Re: Using Panorama to change controlled firewalls Active/Passive

J_Healy — Thu, 19 Jun 2025 20:05:12 GMT

Thank you @TomYoung.