topic Re: PANORAMA UPGRADE from 8.0.19 to 8.1.X template Query in General Topics

PANORAMA UPGRADE from 8.0.19 to 8.1.X template Query

Nischal — Tue, 03 Sep 2019 10:45:27 GMT

I am in process of upgarding our Panorama (M-100) from 8.0.19 to 8.1.X code.

I have gone through below URL for upgrade consideration and procedure to upgrade PAN.

One thing i feel is critical to my enviroment is Template. We use regular template however 8.1.x code support template stack.

As per online documention , conversion from template to template stack will be automatic.

As its our production environment (90+ firewalls) and we cannot test (Azure PAN support 8.1.X only) i am bit skeptical how things will behave at time of migration.

Has anyone upgarded PAN from 8.0.X to 8.1.X ? If yes, did they face any issue? Please share your real time experience.

Here are the upgrade considerations:
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/upgrade-to-pan-os-81/upgradedowngrade-considerations.html

HOW TO UPGRADE PAN-OS AND PANORAMA
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRrCAK

Re: PANORAMA UPGRADE from 8.0.19 to 8.1.X template Query

S.Cantwell — Tue, 03 Sep 2019 18:46:53 GMT

Hello there.

when we upgraded from 8.0 to 8.1, our templates were put together into a single stack.

Considerations to ensure you are aware of

8 templates in a stack.

template in highest position will override any duplicate template info in a lower template.

So, ensure your most specific information/tempate, is at the highest position.

example

template-for-US-West DNS server (192.168.1.20)

template-for-US-general DNS server 10.10.1.100)

template-for-DNS-world DNS server 172.16.1.55

because template-for-US-West is in top postion of stack, the xml config that any US-West FWs would get would be 192.168.1.20.

Make sense?

When you upgrade from 8.0 to 8.1, the Panorama will automatically create a auto-restore-8x configuration snapshot file for you.

So, worst case, you can downgrade from 8.1 to 8.0, and have your original configuration back.

Let me know what other questions you have.

Re: PANORAMA UPGRADE from 8.0.19 to 8.1.X template Query

Nischal — Wed, 04 Sep 2019 05:08:51 GMT

Thanks Steve, that was helpful . However , you mentioned you put template in single template stack manually, did you anticipated issues how auto coversion feature will handle conversion of template to template stack when doing an upgrade and hence you choose to do it manually prior upgrade?

Re: PANORAMA UPGRADE from 8.0.19 to 8.1.X template Query

Nischal — Wed, 11 Sep 2019 09:50:19 GMT

I left template as it is and upgraded PAN to 8.1.9-h4 from 8.0.19 and template stack got automatically created with correct device mapping as expected. The Upgrade went smooth with no issues so far.