PanOS upgrade strategy

Kandarp_Desai — Tue, 15 Mar 2022 16:38:52 GMT

Hi All,

We are running PA firewalls + Panorama + Prisma Access in our environment. Our aim is to upgrade our cloud prisma plugin to 3.0 for additional features, however we are not getting the best approach to do this.

Our existing environment is :

Device	Current version	Expected Version

Bunch of firewalls in HA pairs	9.1.8	10.1.4-h4
Panorama	9.1.13	10.1.4-h4
Cloud Services Plugin	2.1.0-h12.preferred	3.0 preferred
Dataplane version	10.0.3	-
VM-series Plugin	2.0.4	-

How should one approach this ?

(1) Upgrade the Panorama + Plugins gradually ( 9 ---> 10.0 --->10.1 etc ) keeping the firewalls as is and then once Panorama + Plugins are upgraded we target the firewalls.

(2) Upgrade the Panorama + Plugins + Firewalls all at once

(3) Any other options ( we can have 0 downtime )

Re: PanOS upgrade strategy

Mudhireddy — Tue, 15 Mar 2022 16:53:27 GMT

Hi Kandarp,

I recommend going with the first option instead of all at once.

Important notes before upgrading:

•If using Panorama management in an HA configuration, HA must be set up before setting up Prisma Access management.

•Every Prisma Access cloud services plugin has a specific range of supported Panorama versions it is rated to work with. Ensure that Panorama and the cloud services plugin are at compatible versions each time the plugin is installed or updated.

topic PanOS upgrade strategy in General Topics

PanOS upgrade strategy

Re: PanOS upgrade strategy