topic Re: Upgrading Panorama and Firewalls to 7.0.3 in General Topics

Upgrading Panorama and Firewalls to 7.0.3

Scott_Sadlocha — Mon, 02 Nov 2015 20:40:08 GMT

Hey All,

I have some questions regarding the upgrade of Panorama and firewalls to version 7.0.3. I am looking to upgrade both fairly soon, and want to avoid any gotchas. My environment currently has Panorama at 6.1.4 and all firewalls at 6.1.4 or 6.1.2. I am aware of the need to upgrade to major versions prior to minor versions (for example, 7.0 before 7.0.3). The first question I have is regarding Panorama. I just did a Check Now for my Panorama software, and a base 7.0 did not show up, only 7.0.1, 7.0.2, and 7.0.3. Does Panorama not adhere to the 7.0 base first rule?

With regard to the firewalls, I see what looks like a base 7.0 under Device Deployment>Software in my Panorama console. However, it seems to be named different (See screenshot below) and has an "m" designation. Based on what I read, I would be downloading and installing this, then downloading and installing the 7.0.3 version for my firewall model, correct? Also, how long can I wait between upgrading Panorama and the firewalls. I had thought to upgrade Panorama and wait a few days before doing the firewalls, but now I see mention of an LDAP issue when doing a commit through Panorama when it is 7.x and the firewalls are 6.x. These are the gotcha type issues I am hoping to avoid.

If anyone can provide insight on their experience with the upgrade process, I will greatly appreciate it.

Re: Upgrading Panorama and Firewalls to 7.0.3

singh — Mon, 02 Nov 2015 21:53:26 GMT

Hi Scott,

PAN OS 7.0.0 was pulled off due to a major vulnerability. So, it is no more available for downloads and the base image has been replaced by 7.0.1. So, you will need to download 7.0.1 to upgrade to higher major versions.

Re: Upgrading Panorama and Firewalls to 7.0.3

Scott_Sadlocha — Mon, 02 Nov 2015 23:02:49 GMT

I just realized I forgot my screenshot. Sorry about that.

Re: Upgrading Panorama and Firewalls to 7.0.3

Scott_Sadlocha — Mon, 02 Nov 2015 23:04:23 GMT

Thank you for the information @singh I appreciate it. Can you verify whether upgrading Panorama requires the base version first routine? In the instructions I found, it is not clear whether this is appropriate for Panorama, or just the firewall.

Re: Upgrading Panorama and Firewalls to 7.0.3

OtakarKlier — Mon, 02 Nov 2015 23:40:20 GMT

I could be wrong, however I think you just need the version downloaded to the firewall so you dont have to upgrade twice.

i.e. going from 6.1.4 ->download the base 7.0.x ->download 7.0.x and install.

Re: Upgrading Panorama and Firewalls to 7.0.3

OtakarKlier — Mon, 02 Nov 2015 23:53:54 GMT

According to the steps, you just need to download the base image and then download/install the image you want to go to:

https://www.paloaltonetworks.com/documentation/70/pan-os/newfeaturesguide/upgrade-to-pan-os-7-0/upgrade-the-firewall-to-pan-os-7-0.html#17982

Re: Upgrading Panorama and Firewalls to 7.0.3

Scott_Sadlocha — Tue, 03 Nov 2015 17:42:53 GMT

Okay, I am just going to take Panorama right to version 7.0.3 straight away.From what I have read, it seems Panorama can be taken directly to where it needs to be.

For the actual firewalls, I will follow the directions regarding the base version and then the maintenance version.

Anyone have any other comments or advice?

Re: Upgrading Panorama and Firewalls to 7.0.3

OtakarKlier — Tue, 03 Nov 2015 17:48:50 GMT

Since you have the Panorama, just check and make sure that you are getting config backups of the PAN's. If not, then either configure the Panorama to get them, or just download the configs (more safe than sorry approach). Other than that its pretty straight forward.

Re: Upgrading Panorama and Firewalls to 7.0.3

singh — Tue, 03 Nov 2015 17:55:36 GMT

Base image is required for both Panorama and firewall.

Re: Upgrading Panorama and Firewalls to 7.0.3

Scott_Sadlocha — Tue, 10 Nov 2015 14:17:28 GMT

Thank you for the comments everyone. I am going to attempt to upgrade Panorama and my firewalls this Thursday evening, and I am hoping it goes well.