Best upgrade practice with HA Pair ?

Walt — Tue, 12 Dec 2023 13:50:10 GMT

We are preparing to update this weekend to 10.2.7 to resolve the expiring root certificate issue. We have an HA pair that we want to failover while upgrading as to not disrupt service. While I have the upgrade path from the Palo documentation what I am not sure of is if I can fully upgrade the secondary, failover and then fully upgrade the primary and fail back or if I need to fail back and forth between each step? See below, which option is recommended? Obviously Option A is the preferred choice if it will work but I want to be sure doing it that way won't cause an issue. What do others do?

Option A
Upgrade secondary to 10.1.11h1
Upgrade Secondary to 10.2
Upgrade Secondary to 10.2.7
Fail over to Secondary
Upgrade Primary to 10.1.11h1
Upgrade Primary to 10.2
Upgrade Primary to 10.2.7
Fail back over to Primary

Option B
Upgrade secondary to 10.1.11h1
Fail over to Secondary
Upgrade Primary to 10.1.11h1
Fail over to Primary
Upgrade Secondary to 10.2
Fail over to Secondary
Upgrade Primary to 10.2
Fail over to Primary
Upgrade Secondary to 10.2.7
Fail over to Secondary
Upgrade Primary to 10.2.7
Fail over to Primary

Re: Best upgrade practice with HA Pair ?

OtakarKlier — Tue, 12 Dec 2023 15:49:31 GMT

Hello,

Option A would be the route I take.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/upgrade-an-ha-firewall-pair

Regards,

topic Best upgrade practice with HA Pair ? in General Topics

Best upgrade practice with HA Pair ?

Re: Best upgrade practice with HA Pair ?