topic Re: Panorama HA upgrade to 10.0 in Panorama Discussions

Panorama HA upgrade to 10.0

Deepak_K — Mon, 03 May 2021 13:02:32 GMT

We have query regarding log collector group while upgrading Panorama M200 Ha pair from PANOS 9.1.6 to PANOS 10.0.5.

Is there any issue in log collector status or log forwarding to collector group ?

We have log collector group( with enable log redundancy) and local log collector of both panorama are added into same LC group in our production setup. HA and log collection config using management interface on both panorama.

We have tested Panorama HA upgrade from PANOS 9.1.6 to PANOS 10.0.5 on testing setup.(We couldn't configured LC in testing setup)

First we have upgraded Primary Panorama to Panos 10.0.5 , when it came up it went to non-functional state due to panos version mismatch. HA1 was up and secondary panorama became active.

To make the upgraded Primary panorama device functional had to suspend Secondary panorama. HA1 was up even after suspending Secondary panorama.

Is there any issue in log collection or LC status if we suspend secondary panorama

If yes, then logs should redistribute from LC1 (pri panorama ) to LC2 ( Sec panorama ) after making secondary panorama functional.

We want to keep production Sec Panorama in suspend state and want to monitor upgraded pri panorama for 7 days.

So after upgrading panorama after 7 days , LC2 of sec panorama should have some logs stored in its logging disks.

Re: Panorama HA upgrade to 10.0

reaper — Tue, 04 May 2021 21:13:17 GMT

hi @Deepak_K

a suspended panorama with log collector will still receive logs, so you can keep panorama suspended while the log collector will still technically work

but

since you have redistribute enabled/multiple collectors in the same group, they can not run different PAN-OS versions at the same time without risking log data loss: all log collectors in the same group must be upgraded at the same time

Re: Panorama HA upgrade to 10.0

Deepak_K — Wed, 05 May 2021 10:05:52 GMT

Thanks @reaper

In our case we have configured local log collector on primary and secondary panorama. And each log collector of panorama we have added in collector group and enabled redundancy, so is your statement applicable to this setup?

Our only concern is local log collector of secondary panorama should receive and store the logs in below conditions :

* Secondary panorama suspended

* Panorama version mismatch

Here we are upgrading only primary panorama , log collectors added in collector groups are local not dedicated hardware. So both log collector should not face any issue if panorama version is mismatched.

Re: Panorama HA upgrade to 10.0

reaper — Wed, 05 May 2021 13:39:46 GMT

log collection during a suspended panorama will work, but in regards to upgrading:

all log collectors that are in the same collector group need to be upgraded at the same time, else you risk losing data

Re: Panorama HA upgrade to 10.0

Deepak_K — Wed, 05 May 2021 15:11:20 GMT

@reaper thanks again for answering my query.

Practically it's not possible to upgrade panorama HA pair at same time. Even if we try , there we be some difference in uptime.

So we will lose historical logs or the new incoming logs during version mismatch ?