Pan OS upgrade in HA pair 10.0.9 to 10.2.3

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Pan OS upgrade in HA pair 10.0.9 to 10.2.3

L1 Bithead

I have vm series in ha pair managed by the panorama(10.2.3). When I look the upgrade path it appears

10.0.9 ->10.0.11-h1 -> 10.1.0 ->10.1.10->10.2.0 -> 10.2.3. I have confusion on fail over, do I need to fail over on each version?

 

Thank you.

 

 

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Yes I skip manual failover.

After passive is upgraded/rebooted I upgrade and reboot active and let firewalls to perform HA automatically.
When active goes to reboot then passive will become automatically active.

 

As I often upgrade remote firewalls I don't like to place any firewall into suspend state.

I also have preemt enabled so when primary firewall returns from reboot it will take active role back automatically as well.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

View solution in original post

3 REPLIES 3

Cyber Elite
Cyber Elite

Yes you need to fail over every time.

Upgrade passive, reboot.

Upgrade active, reboot.

repeat...

 

Although I like path you suggested and I follow it myself there is a way to save time if you are in a rush.

 

Starting point 10.0.9

Download and install 10.0.11-h1

Download 10.1.0

Download and install 10.1.10

Download 10.2.0

Download and install 10.2.4 (10.2.3 unless you can upgrade Panorama before).

 

10.2.4 is currently preferred release.

Raido_Rattameister_0-1685125563207.png

 

 

One thing to keep in mind is that virtual Palos use hypervisor assigned mac addresses not virtual floating mac.

This means that mac addresses change during failover.

If you have devices that don't accept gratuitous arp then you need to clear their arp table.

 

Good example is other Palo firewalls themselves that don't update their arp table if gratuitous arp is received.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

L1 Bithead

Thank you for your detailed responses. One more clarification, are you skipping the steps for 'Disable preemptive, request high-availability state suspend and request high-availability functional state? for each fail over or is that included?

 

Thanks again.

 

Cyber Elite
Cyber Elite

Yes I skip manual failover.

After passive is upgraded/rebooted I upgrade and reboot active and let firewalls to perform HA automatically.
When active goes to reboot then passive will become automatically active.

 

As I often upgrade remote firewalls I don't like to place any firewall into suspend state.

I also have preemt enabled so when primary firewall returns from reboot it will take active role back automatically as well.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011
  • 1 accepted solution
  • 1336 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!