Up gradation of PANOS 8.0 to 8.1

Shuaib_Khalid — Thu, 24 Oct 2019 06:55:19 GMT

We have PA-820 deployed in Active-Passive HA mode running PANOS 8.0. Today i received a notification that PANOS 8.0 will be End of Life on 31st Oct 2019. Hence I have to upgrade the PANOS of both firewalls, preemption is enabled on both firewall. Please share the procedure / best practices of upgrading OS in HA (Active-Passive) with no traffic outage.

Re: Up gradation of PANOS 8.0 to 8.1

michelealbrigo — Thu, 24 Oct 2019 08:06:03 GMT

I manage an active/standby pair of PA-5220. Priority is 102 on standby and 101 on active, preemption and config sync enabled.
This is what I do:

- upgrade standby to new release
- let it run (as a standby) for a couple of hours

- set standby priority to 100, to switch roles with preemption

- let it run as active for some hours
- upgrade formerly active firewall to new release

- another couple of hours of monitoring...

- switch back priority to 102, to revert firewalls to original roles

I find this procedure to be "smoother" on clients than the standard/recommended one, which says to suspend the active to force failover. This might be due to my network topology, anyway, which combines OSPF and a lack of pre-negotiation mechanisms. We are working on that.

Of course you can cut it shorter on monitoring, esp. when the minor release is high and you can trust PAN-OS review a bit more (e.g. 8.1.9 to 8.1.10). I only "move" between preferred releases.

topic Up gradation of PANOS 8.0 to 8.1 in General Topics

Up gradation of PANOS 8.0 to 8.1

Re: Up gradation of PANOS 8.0 to 8.1