topic Pre-Install Pan Upgrade with no reboot in General Topics

Pre-Install Pan Upgrade with no reboot

epeeler — Mon, 17 Apr 2017 13:19:08 GMT

Does anyone download and install PANOS updates but wait to reboot until a scheduled maintenance window? I'm wondering how risky this would be and/or how long you can let a firewall sit waiting for a reboot to the installed new version.

This would save time during our rather short maintenance windows if I could pre load the install during regular hours and then just come in on a weekend and reboot.

Anybody do it this way? If so, have you experieneced any unexpected behavior or outages as a result?

Re: Pre-Install Pan Upgrade with no reboot

BPry — Mon, 17 Apr 2017 13:24:56 GMT

I've always pre-loaded a few hours before my scheduled windows and then just let it sit there as I wait for the window to actually hit. I think the longest I've probably let it sit like that was 3 hours roughly? I've only once experianced an issue with it and that was due to a UPS issue that cut the power and essentially restarted the box before I wanted it to; it caused production to be down for a little while since I had preloaded it on both active and passive units and it installed on both of them at the same time. I've learned since then and will update the passive unit like this, perform the update and move traffic over to the upgraded unit, and then take my time upgrading the remaining unit since there really isn't an urgency to doing so anymore.

If you only have one unit then the only risk you really take is an extended outage if you have any power issues. Since it takes awhile to actually come up when it's loading the upgrade this could put your production enviroment down for longer than you would like.

Re: Pre-Install Pan Upgrade with no reboot

Raido_Rattameister — Tue, 18 Apr 2017 01:00:11 GMT

New software version is installed to other partition.

If you reboot the box then it boots into new release.

Old software is left there also so you can always revert.

You can use cli command "debug swm status" to view those partitions and software versions they hold.

It is safe to install and leave it without reboot to wait for maintenance window.

Re: Pre-Install Pan Upgrade with no reboot

BPry — Tue, 18 Apr 2017 12:58:19 GMT

@Raido_Rattameister,

I think the biggest 'issue' that people run into when doing this is simply the time that the box takes to boot once you have pre-loaded a new software version. In my experiance on multiple different devices it takes a good while longer than simply restarting the box.

Re: Pre-Install Pan Upgrade with no reboot

Raido_Rattameister — Tue, 18 Apr 2017 14:25:16 GMT

Agree that boot time after software install takes longer so in case of power failure environment will be down longer indeed.

Re: Pre-Install Pan Upgrade with no reboot

epeeler — Tue, 25 Apr 2017 13:03:08 GMT

Great information here guys. Thanks for the input.