SSL Connection Error During Panorama-Orchestrated HA Upgrade

[M.Knabikas]

Hi all,

First time posting, so bear with me. We manage fairly large fleets of devices across multiple clients, so the new HA upgrade orchestration from Panorama looked like a big time-saver. We decided to test it with one client but ran into the issue shown in the screenshot: "Download error: SSL connection error".

Has anyone encountered this — either with orchestrated HA upgrades or standalone upgrades — and have an idea where to start troubleshooting?

Some additional context:

• Both firewalls had  same PAN-OS base version downloaded on them
• Both can reach the update server (updates.paloaltonetworks.com)
• Device certificates are valid and up to date

Appreciate any insights or discussion.

[kiwi · Accepted solution]

Hi @M.Knabikas ,

Make sure that TCP port 28443 is open in this communication and no intermediate device is blocking traffic.

28443 TCP - Used for managed devices (firewalls and Log Collectors) to retrieve software and content updates from Panorama. 
Only devices that run PAN-OS 8.x and later releases retrieve updates from Panorama over this port. 

Source:

https://docs.paloaltonetworks.com/ngfw/administration/firewall-administration/reference-port-number-...

Hope this helps !

[M.Knabikas]

Hi,

Thanks for the follow-up!

Yes, opening TCP 28443 was the solution. Note that the direction matters — the port needs to be open from Panorama to the managed firewalls, not the other way around.

The feature works well overall. One minor issue we noticed: the update window would occasionally get stuck visually on a step (e.g., "upgrading second firewall") even after that firewall had already completed the upgrade. This appears to be a display/UI glitch only — functionality was not affected.