Pre-Install Pan Upgrade with no reboot

[epeeler]

Does anyone download and install PANOS updates but wait to reboot until a scheduled maintenance window?  I'm wondering how risky this would be and/or how long you can let a firewall sit waiting for a reboot to the installed new version.

This would save time during our rather short maintenance windows if I could pre load the install during regular hours and then just come in on a weekend and reboot.

Anybody do it this way? If so, have you experieneced any unexpected behavior or outages as a result?

[BPry · Accepted solution]

I've always pre-loaded a few hours before my scheduled windows and then just let it sit there as I wait for the window to actually hit. I think the longest I've probably let it sit like that was 3 hours roughly? I've only once experianced an issue with it and that was due to a UPS issue that cut the power and essentially restarted the box before I wanted it to; it caused production to be down for a little while since I had preloaded it on both active and passive units and it installed on both of them at the same time. I've learned since then and will update the passive unit like this, perform the update and move traffic over to the upgraded unit, and then take my time upgrading the remaining unit since there really isn't an urgency to doing so anymore.

If you only have one unit then the only risk you really take is an extended outage if you have any power issues. Since it takes awhile to actually come up when it's loading the upgrade this could put your production enviroment down for longer than you would like.

[Raido_Rattameister · Accepted solution]

New software version is installed to other partition.

If you reboot the box then it boots into new release. 

Old software is left there also so you can always revert.

You can use cli command "debug swm status" to view those partitions and software versions they hold.

It is safe to install and leave it without reboot to wait for maintenance window.

[BPry]

@Raido_Rattameister,

I think the biggest 'issue' that people run into when doing this is simply the time that the box takes to boot once you have pre-loaded a new software version. In my experiance on multiple different devices it takes a good while longer than simply restarting the box.

[Raido_Rattameister]

Agree that boot time after software install takes longer so in case of power failure environment will be down longer indeed.

[epeeler]

Great information here guys. Thanks for the input.