topic Re: Upgrading PAN-OS active/passive question in General Topics

Upgrading PAN-OS active/passive question

AnthonyT — Wed, 22 Mar 2023 15:23:50 GMT

I have 2 firewalls in active/passive mode. Am I able to upgrade one of the PAN's and leave the other in standby or passive mode for a few days while I ensure there are no issues before upgrading the second PAN? It is a jump bigger than 2 versions so the PAN I do not upgrade should go into standby mode. Will I be able to then upgrade the device in standby mode and return to active/passive mode?

Re: Upgrading PAN-OS active/passive question

OtakarKlier — Wed, 22 Mar 2023 16:09:54 GMT

Hello,

Ideally you would want to have the two on the same code version. However I would say make sure they are on the same family at least, ie 10.1.x. If the new code is going to be changing one of the two, i would recommend upgrading both. Or if your change management approves, run without HA or in a degraded state.

Check out this link for the recommended release version:

https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304

Re: Upgrading PAN-OS active/passive question

AnthonyT — Wed, 22 Mar 2023 16:27:06 GMT

Thank you, I am just worried about, if the upgrade breaks anything I wanted an easy way to revert to known working config. The easiest way I could think of is to upgrade 1 PAN then the other after a day of use. Is there a better/smarter way to do this?

Re: Upgrading PAN-OS active/passive question

AnthonyT — Wed, 22 Mar 2023 16:28:13 GMT

and thanks for the link, I do not have enough access into Palo Alto support to view the link though.

Re: Upgrading PAN-OS active/passive question

OtakarKlier — Wed, 22 Mar 2023 17:28:20 GMT

Hello,

You might not have HA working correctly, but if your bosses are OK and have signed off in writing, then shouldnt be problem. Here is the recommended procedure to follow:

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/upgrade-an-ha-firewall-pair

Regards,

Re: Upgrading PAN-OS active/passive question

AnthonyT — Wed, 22 Mar 2023 19:38:29 GMT

I think I will upgrade the pair tonight rather than doing one, waiting and doing the other. If I have to revert to the version I am currently on for some reason. Is the process difficult? It looks like If I take a snapshot between each installation on the way to 10.1 I should be able to work backwards to get back to the version I am currently on?

Re: Upgrading PAN-OS active/passive question

OtakarKlier — Wed, 22 Mar 2023 22:06:05 GMT

Hello,

Its pretty much the same as the upgrade except in reverse.

Regards,

Re: Upgrading PAN-OS active/passive question

reaper — Thu, 23 Mar 2023 08:59:47 GMT

I'd like to inject a word of caution here, in favor of doing both peers during the same maintenance window

If you upgrade a member to a +1 major release, the upgraded member will go into 'nonfunctional' state which means it will take on a passive role and only assume the active role if the not-upgraded member goes down or is suspended. if you intend to 'test' this OS for a while you'd need to manually suspend the not-upgraded peer

if you upgrade one member +2 major versions, it will go into a forced suspend mode that you cannot recover from unless the other member is down, and then you can manually activate (unsuspend) it. so for this to run for more than a few minutes, you'd have to shut down or disconnect your other member

reverting one upgrade down can be easily achieved by running `debug swm revert` + `request restart system` from CLI (because the previously installed OS is maintained on an inactive disk partition), going down further requires a software install

protip on the upgrades: unless you're working on an old hardware, you can download the base image, download the maintenance version, and then directly install and boot into the latest maintenance release for a major version (e.g. 10.0.x directly to 10.1.9). even for the 'inbetween' version i'd recommend going to the latest maintenance release immediately as you don't want to get snagged on a bug mid upgrade

Re: Upgrading PAN-OS active/passive question

AnthonyT — Thu, 23 Mar 2023 12:41:44 GMT

I elected to upgrade both peers last night and so far everything is working as expected. Thanks for all the assistance, it is greatly appreciated.