topic Re: FW HA Version Update in General Topics

FW HA Version Update

manuellara — Fri, 26 Jan 2024 23:16:42 GMT

Good afternoon team:
Could you support me on how is the HA version upgrade process?
First the passive fw? then the active one?

Greetings.

#paloaltoHA #update

Re: FW HA Version Update

PavelK — Sat, 27 Jan 2024 02:33:02 GMT

Hello @manuellara

here is the official documentation: Upgrade an HA Firewall Pair. The official documentation recommends for active/passive firewalls to suspend (fail over) and upgrade the active (primary) peer first, then failback and continue the upgrade with the other firewall, however based on my past experience it is ok to start with passive firewall first.

Kind Regards

Pavel

Re: FW HA Version Update

KWIlson01 — Thu, 29 Feb 2024 18:35:18 GMT

Hey Pavel,
I've done upgrades on HA firewall device groups for a long while. I've always done the passive-firewall upgrade first, then F/O and upgrade the other peer. Is the initial F/O (before upgrade) done to test HA function before upgrading? (Of course I could be misremembering old procedures.)

Re: FW HA Version Update

BPry — Thu, 29 Feb 2024 22:42:31 GMT

@KWIlson01,

It's my understanding that this is the intent of the official documentation. In the event that this doesn't work for some reason you have a known good unit to restore traffic that hasn't been modified at all.

In the event that you upgrade the passive firewall and failover and encounter an issue, you've introduced two variables at the same time. It could either be that the passive firewall couldn't handle traffic appropriately to begin with, or it could be the new code causing an issue.

Personally I recommend testing failover at least once a month to validate that everything is functional, and with that I personally always do passive/secondary upgrade first and then move on to the active/primary unit. If you know that failover is actually going to function, the initial failover is just (to me) adding an unnecessary step.

Re: FW HA Version Update

KWIlson01 — Thu, 29 Feb 2024 22:48:07 GMT

@BPry ,
Appreciate the detail, and thoughts on the procedure. Very good points for best practice.