Reboot/upgrade time approximate/estimate Panorama M-200

[Metgatz]

Reboot/upgrade time approximate/estimate Panorama M-200

Good morning, thank you for the help and collaboration as always.

Question, how many hours it takes approximately to perform the following Upgrade of Panorama M-200, when the reboot is performed by the version to install:

1.- Reboot/upgrade time - M-200 PAN-OS 9.1.4 to 9.1.14-h4 ( recommended by TAC )

2.- Reboot/upgrade time - M-200 PAN-OS 9.1.4 to 10.0.11-h1 ?

3.- Reboot/upgrade time - M-200 PAN-OS 10.0.11-h1 to 10.1.6-h6 ?

Considering this Link/KB:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClyWCAS:  This KB indicates that after 90 days, when rebooting, it applies a check of the disks, which will take much longer, considering a Panorama M-200 16TB RAID storage (4 8TB RAID certified drives preinstalled).

I remain attentive

Thank you

Best regards

[PavelK]

Hello @Metgatz

for point No.1, from my experience it takes couple of minutes to reboot, then after it comes up, it takes approximately 1 to 1.5 hours before logs are searchable.

For points 2 and 3, I can't answer it with certainty, however I have scheduled one upgrade of M-200 with the same scenario in early October. If you can wait until then, I can share you my experience.

Regarding the KB you mentioned, I read it in the past, but never hit this issue. I upgrade Panorama with every PAN-OS release, however even though my upgrade cycle is sometimes outside of 90 days period, I never run into this.

Kind Regards

Pavel

[Metgatz]

Hello colleague

Excellent, thank you very much, that's perfect. If you can share that experience with me, since I will most likely prepare this upgrade for the end of October 2022, so I will benefit a lot from your feedback and your experience with this upgrade.

Thank you, excellent day, I will be attentive

Best regards

[PavelK]

Hello @Metgatz

I would like to come back to you to share the upgrade experience.

When I started the upgrade, I was running 9.1.14. After the installation of 10.1.11-H1, the reboot took couple of minutes. After Panorama came up all Firewalls were out of sync for Device Group and Template Stack. The preview of changes showed up only an  empty window with no changes in it. I pushed it to sync all up. All the logs were available within 1 hour.

Next step was upgrade from 10.1.11-H1 to 10.1.7. The reboot took again couple of minutes. The Panorama came up with Device Group out of sync for all Firewalls. I pushed it again to sync all Firewalls. The logs were searchable within 40 minutes.

In my case, I have 6 Panorama nodes (2x Panorama + 4x Log Collectors). In your case, I think you have less devices and less logs, so it should not take that long to see all the logs again after the upgrade. The installation and reboot time should be the same.

Overall experience was smooth without any issue.

Kind Regards

Pavel

[Metgatz]

Hello @PavelK thank you very much for your comment and for taking the time to do so.

Thank you for taking the time to share your details and your experience.

Now I am still concerned about this issue that appears in the link, regarding the PANORAMA that have an Uptime of more than 90 days, the one I have to upgrade, has an uptime of almost 400 days. So according to the article/KB:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClyWCAS

If Panorama has not been rebooted in 90 days, it will require e2fsck (File System Check) to be run during bootup.  This will happen every 4 reboots for single mount and 8 reboots for Dual Mount Disks or "90 days, since the last fsck was performed, whichever first".   This could take a couple hours depending on the size of the file system. If maximum 2TB storage is allocated, it can possibly take several hours.

When you did the upgrades and therefore the restarts, was the PANORMA disk check ( fsck ) performed on the boot ? as the article indicates? How much uptime did your PANORAMA have at the time of the upgrade and restarts?

Thank you very much

I look forward to your comments

Best regards

[PavelK]

Thank you for reply @Metgatz

Unfortunately, with this I am not able to assist anymore. I never experienced the behavior described in the KB. In most cases, I run the upgrade for every PAN-OS release, which is approximately 3 month or less.

Kind Regards

Pavel

[PavelK]

I have noticed there is a new KB: How to check RAID log to see if FSCK will be performed on the next reboot with instructions how to check whether FSCK will be performed.