Information about Palo Alto Software upgrades via SCM

MarcovanW — Tue, 02 Jun 2026 12:17:54 GMT

Hi everyone,

I am trying to get more information on upgrade the PAN-OS software via SCM. I know how to configure and run it using the Groups and Schedules found under software updates page, but I was wondering about the specifics I cannot find in the documentation.

I am hoping anyone here can answer my questions.

1. When creating a schedule that has to install, say at 13:00. In the schedule overview, it gives a time of 13:00 - 15:00 (Window of two hours.) Is this the window it might that it installs the update between, or is it start at 13:00 and try until 15:00 incase of failures?

2. When you open a running schedule, it defines some steps and checks it does. What do those steps do exactly, besides from the obvious ones? Specifically the PRE-CHECK and POST-CHECK step.

3. How does updating an HA-pair work? Do I put them in the same group and schedule? Does it update the Passive unit first, reboots it and does the checks before initiating a failover and updating the other unit? I cannot find it documented anywhere.

Thanks for taking your time reading this and possibly answer my questions.

topic Information about Palo Alto Software upgrades via SCM in Strata Cloud Manager

Information about Palo Alto Software upgrades via SCM