Palo Alto Cluster Upgrade

[NickoKristian]

Hi All,

Our current setup is We have Active/Passive on main dc and standalone fw on DR site. Configured as Cluster.

It is identified that the DR site is affected by a certain CVE, and it is recommended for upgrade. But we also wish to upgrade the Active/Passive Main DC firewall.

I cannot find any articles on how to upgrade an Firewall Cluster, Can you share any tips on what approach upgrade for this setup?

Would there be no effect bearing if for example the Active/Passive Firewall is running on 10.1.0 then the DR Stand alone site is running on 10.1.0 version?

Thanks

[Raido_Rattameister]

Upgrade passive, reboot passive.

Upgrade active, reboot active.

What is your current version and what is goal version?

[reaper]

are your DC and DR clustered (via HA4)? If yes, all members of the cluster should be on the same PAN-OS. If the DR is simply a copy (managed by Panorama or not doesn't really matter), it won't matter if the DR is upgraded way ahead of the normal DC

to upgrade the HA cluster, i'd recommend the following:

- disable preempt

- suspend the primary firewall (this triggers a failover to the secondary, this is a good 'double check' to see if your secondary is passing traffic as expected. if this part fails, troubleshoot connectivity on the secondary before going forward with the upgrade)

- install your desired PAN-OS on the primary

- make primary active again and suspend secondary

- check if everything's still working as expected

- upgrade secondary

- enable preempt again if you had it enabled

if the 'distance' between current and future PAN-OS is too great, you'll have to repeat this process a few times i.e. coming from 9.1 to 10.1 you'll have to do a layover on 10.0 for both peers before moving on to 10.1. 

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade <- the upgrade guide