Best Practices for PAN-OS Upgrade without downtime

[NetworkGeek]

Hello all,

i have Active /passive firewalls

how can i upgrade PAN-OS without downtime ??

1-when i upgrade active , it will reboot then passive will be active ..

2- When i upgrade the new active is it will be back to old active again ?? what about OS mismatching is it have any impact on HA

3- If both devices will be for VPN ? Tunnel will be down with failover ?

[jdprovine]

@markk96

When I have left it mismatched for no more than 12 hours it won't let me commit changes

[jdprovine]

@OtakarKlier

I do a suspend when I fail the primary over to upgrade it and then again on the secondary when I fail back to the primary. But in the past I have not had to suspend the secondary when I go to upgrade it when it is already in the passive position.

[markk96]

I use Panorama, I have not had any issues commiting to them after leaving them mismatched for 24 hours.