topic Re: Query on HA pair upgrade in General Topics

Query on HA pair upgrade

Farzana — Fri, 31 Aug 2018 02:48:26 GMT

Hello,

We are using PAN-OS 7.0.2 which is end of life and wanting to upgrade to 7.1.17.

Can we upgrade one firewall through all the versions 7.0.2-->7.0.19-->7.1.0-->7.1.17 before moving on to another in the pair or do we have to bring both firewalls in pair on same version before making a move onto the next version in line?

Thanks in advance!

Re: Query on HA pair upgrade

reaper — Fri, 31 Aug 2018 09:05:19 GMT

hi @Farzana

yes, you can bring the first fiirewall up to the final version before you start work on the second

Re: Query on HA pair upgrade

Remo — Sat, 01 Sep 2018 13:58:09 GMT

@Farzana

As long as you only upgrade to the next major version I would recommend it the way you describe.

For example if you planned to go from 7.0.2 up to 8.0.10, then you should upgrade both firewalls to 7.1.x before you do the next step to 8.0.x.

Re: Query on HA pair upgrade

Farzana — Mon, 03 Sep 2018 23:16:31 GMT

@reaper, @Remo

Thank you both.

After upgrading the Primary firewall and make it functional again, will it not prompt about the mismatch of the IOS version on the peers in HA. Will The HA work? Will it allow me to suspend the secondary from the HA pair so that primary which will run on new version can take over?

Re: Query on HA pair upgrade

Remo — Tue, 04 Sep 2018 00:55:42 GMT

@Farzana

Yes, the firewalls will show a PAN-OS mismatch but the firewallcluster (including session sync and so on) wil work perfectly fine.