Panorama PAN-OS Upgrade from 9.1.10 to 10.0.7 stuck at 45%

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Panorama PAN-OS Upgrade from 9.1.10 to 10.0.7 stuck at 45%

L1 Bithead

I'm trying to upgrade a Panorama M-600 appliance from 9.1.7 to 9.1.10 (this step succeeded), to 10.0.7. But for the past 2 hours the upgrade has been stuck at 45%:

 

admin@iReport> show jobs id 7330
Enqueued              Dequeued           ID                              Type                         Status Result Completed
------------------------------------------------------------------------------------------------------------------------------
2021/09/10 22:13:24   22:13:24         7330                         SWInstall                            ACT   PEND        45%
Warnings:
Details:

 

I've been on hold for over an hour with Palo, so will try to post the question here. Should I kill the job or reboot? Or do I need to wait as there's TONS of data on the appliance?

 

FYI while Panorama was stuck I upgraded our two PA-5220's from 9.1.7 to 9.1.10 to 10.0.7 without any issues. I know I had to do Panorama first... but I was optimistic about its upgrade succeeding as well.

 

Thanks,

 

Roberto

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

@Roberto_F,

Just for the future, seeing an M-600 take an extended amount of time to perform major version updates is expected behavior. During the upgrade from 9.1 to 10.0 every single log file on the M-600 has to be migrated, so the more logs a system has the longer the process is going to take. I've seen some updates take upwards of 5 hours. Maintenance updates are much quicker because you don't have to do anything to migrate the logs, as they are all already in the proper format. 

 

Also I'd also put out that I personally wouldn't recommend upgrading your M-600 (presumably functioning in Panorama mode) and your firewalls at the same time. If you run into a bug or issue post upgrade and need to downgrade your M-600 you would also need to downgrade your PA-5220s at the same time so they can be managed by Panorama. 

I would recommend upgrading Panorama the week prior to upgrading any of your firewalls. This allows you enough time to see if you'll run into any issues on the Panorama upgrade prior to upgrading any of the firewalls, so you don't have the risk of needing to downgrade multiple devices at the same time. 

View solution in original post

6 REPLIES 6

L1 Bithead

Wow... I'm sooooo glad I didn't jump the gun on rebooting. The upgrade just completed - it took 2hrs and 20 minutes. Life is good again.

Cyber Elite
Cyber Elite

@Roberto_F,

Just for the future, seeing an M-600 take an extended amount of time to perform major version updates is expected behavior. During the upgrade from 9.1 to 10.0 every single log file on the M-600 has to be migrated, so the more logs a system has the longer the process is going to take. I've seen some updates take upwards of 5 hours. Maintenance updates are much quicker because you don't have to do anything to migrate the logs, as they are all already in the proper format. 

 

Also I'd also put out that I personally wouldn't recommend upgrading your M-600 (presumably functioning in Panorama mode) and your firewalls at the same time. If you run into a bug or issue post upgrade and need to downgrade your M-600 you would also need to downgrade your PA-5220s at the same time so they can be managed by Panorama. 

I would recommend upgrading Panorama the week prior to upgrading any of your firewalls. This allows you enough time to see if you'll run into any issues on the Panorama upgrade prior to upgrading any of the firewalls, so you don't have the risk of needing to downgrade multiple devices at the same time. 

L1 Bithead

In addition to BPry's comments (completely accurate), to help anyone running in the same issues after the looong M-600 Panorama upgrade, the M-600 did not show any more firewall logs after the reboot. Neither real-time nor pre-existing logs were being reported. After an hour-long remote support session with Palo's support, they too were at a loss as to the root cause. They collected Panorama's logs to review them offline.

 

The morning after (about 7 hrs later) I checked again just in case... and Panorama was now showing the real-time traffic and had a couple of months worth of past logs. It took the rest of the day, but by the evening all historical logs had reappeared as well.

 

So don't panic if you don't have data after the v9 - v10 upgrade for several hours. They will eventually appear.

 

 

 

 

L1 Bithead

I have also faced same issue... It is usual behavior of upgradation to major software updates... I have done 9.1.4 to 10.1.1 upgrade . its stuck at 45% for more than 20 min for each upgrade.

I have also faced same issue... It is usual behavior of upgradation to major software updates... I have done 9.1.4 to 10.1.1 upgrade . its stuck at 45% for more than 20 min for each upgrade. My OS upgrade is done successfully.

L3 Networker

Hi everyone and thanks a lot for the useful information reported in this thread. I hope I'm not off topic, but does anyone know if the same issue (long upgrade time due to log migration) applies also to the VM version when it's in legacy mode?

  • 1 accepted solution
  • 6949 Views
  • 6 replies
  • 2 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!