Using Panorama to change controlled firewalls Active/Passive

[J.Healy]

I am upgrading all my controlled firewalls using Panorama. I am able to upload, install, and reboot my passive firewalls. But now I need to switch my active/passive firewalls. Is there a way to do this in Panorama? Before I would manually login (GUI or CLI) to each active firewall and use the suspend function to force fail-over. 

If there is a way to do this or something similar in Panorama, please let me know. Thank you.

[PavelK · Accepted solution]

Hello @J.Healy

thanks for posting.

To my knowledge there is no way to trigger Firewall failover directly from Panorama. I think the technical reason for this is Panorama is primarily designed for central configuration and log management and not direct real time operations.

In the past when I was doing Firewall upgrades, I had exactly the same question as you. Having Firewall failover capability directly from Panorama was feature I was missing. I eventually limited Panorama triggered upgrades only for stand alone Firewalls. HA pairs, I used to upgrade directly from Firewalls.

Kind Regards

Pavel  

[TomYoung · Accepted solution]

Hi @J.Healy ,

Like you I use Panorama to upgrade my NGFWs because it saves me from having to download and install on each one.  I still log in to each one to suspend and make functional because I make sure the standby is in a passive state before I fail over.  In the long run, it would be good for Panorama to do it all with one click.

Upgrade HA Pair button:

1. Upgrade passive.
2. Wait and verify passive is ready for failover.
3. Suspend active and upgrade.
4. Verify all HA checks passed.

You could even have it make the original one active again.

It is interesting that you can suspend the NGFW with SCM.

Thanks,

Tom

[J.Healy]

Thank you @PavelK. I was afraid you were going to say that. 🙂

[J.Healy]

Thank you @TomYoung.