Palo Alto VM-300 firewall in Azure with 40GB system disk needs 60GB for PAN-OS 10.0 upgrade

[palo_altogether]

Hello all,

We have a Palo Alto VM-300 firewall in Azure which was deployed from the market place with a 40GB system disk.

To upgrade to PAN-OS 10.0 and above, the system disk needs to be a minimum of 60GB.

Has anyone done this before?

What is the best approach?

Thanks

[karlgillego]

I want to preface this by saying that after completing the below in a DEV environment, we ended up completely swapping out with new VMs built directly on 9.1.x in PROD.  It just didn't seem like this was going to be supported by TAC.

IMO, Palo's KB (link #1) on this topic is unfortunately rather vague.  The only thing the article offers after cloning the osDisk is

• Remove the original system disk.
• Power on the VM-Series firewall.

It is not that simple in Azure as you cannot detach an osDisk from a VM even if it has been deallocated.  What ended up working is the following.

1. Take a snapshot of the existing osDisk.
2. Create a new disk that's 60GB in size using the snapshot as a source.
3. Use method in Link #2 to swap the osDisk while the VM is deallocated.

It did appear to work as after the upgrade to 9.1.x, the new disk was partitioned correctly.

You should also be aware that we ran into a known issue with PAN-167306 (Link #3).  After the upgrade to 9.1.x, it was as if the secondary dataDisk attached for logging was completely gone.  After the step upgrades finished, another reboot from the Azure side (not the PAN-OS side) was required for the dataDisk to mount correctly.

Link #1: https://docs.paloaltonetworks.com/vm-series/8-1/vm-series-deployment/about-the-vm-series-firewall/up...

Link #2: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/os-disk-swap#code-try-1

Link #3: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-addressed-issues/pan-os...