topic Re: Different version in General Topics

Different version

DGonzalezAR — Wed, 04 Mar 2020 14:27:18 GMT

I have version 8 on a PA 3220 and on the secondary device ( hot stand by ) we have version 9, there is some problem in that they work with different versions

Re: Different version

Vikashh — Wed, 04 Mar 2020 16:00:49 GMT

You need to match PAN OS version.

Re: Different version

atluri4b8 — Wed, 11 Mar 2020 14:20:13 GMT

@DGonzalezAR

The HA peers should have the same version of PAN-OS and content version, in order to set them into a HA pair.

Refer to the documentation below on the HA overview for further details,

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/high-availability/ha-overview.html

Thanks.

Re: Different version

johnde — Wed, 11 Mar 2020 17:06:00 GMT

In order to work HA properly, Both the firewalls should be running the same PAN-OS version and must each be up-to-date on the application, URL, and threat databases.

Re: Different version

AhmedMoustafa — Wed, 11 Mar 2020 18:35:41 GMT

That mean if i need to upgrade the OS on HA we going to have outage in your Scenario.

So, If i need to upgrade the OS.

I have to trigger fail over to pass the traffic through Passive Device.

Then upgrade the Active one and trigger the failover to pass the traffic again to Primary Device.

I think, the Ha should work if we don't have BIG major GAPS between PAN-OS version.

I hope you correct me if i am wrong !

Re: Different version

atluri4b8 — Wed, 11 Mar 2020 18:58:32 GMT

@AhmedMoustafa

When we are upgrading the OS on a HA pair, for active/passive firewalls, must upgrade the passive peer first, suspend the active peer (fail over), update the active peer, and then return that peer to a functional state (fail back).

To prevent fail over during the upgrade of the HA peers, must make sure preemption is disabled before proceeding with the upgrade. We only need to disable preemption on one peer in the pair.

You can check the upgrade steps in the link below.

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/upgrade-to-pan-os-90/upgrade-the-firewall-to-pan-os-90/upgrade-an-ha-firewall-pair-to-pan-os-90.html

Re: Different version

DGonzalezAR — Thu, 12 Mar 2020 13:46:16 GMT

Thank you very much we have taken the team to secondary to version 8 and it has worked perfectly then we will migrate to version 9