Palo Alto Upgrade

-

Support PAN-OS Software Release Guidance 

https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304


Standalone Firewall Upgrade from 9.1 to 10.2.5

0.install latest content release.
1. patch 9.1 to 9.1.16
2. download 10.0 NO install
3. download 10.0.11-h1 and install
4. download 10.1 NO install
5. download 10.1.10-h2 and install
6. download 10.2.0
7. download 10.2.5 failed, 10.2 image disappeared. tried multiple times, same result, even with other 10.2.x images
7a. downlead 10.2.0 and install
8. downlead 10.2.5 and install


HA Firewall Upgrade from 9.1 to 10.2.x

HA Firewall Upgrade from 9.1.0 to 10.2.x

FW-A has priority 50, preemptive is Enabled, status is Active; FW-B has priority 100, preemptive is Enabled, status is Passive.

  • Backup configuration.
  • Install latest content release on both units. Verify HA status and configuration is in sync.
  • ======Patch to 9.1.x=========
  • FW-A, disable preemptive, submit the change.
  • FW-A, download 9.1.x (synch to peer)
  • Suspect FW-A, check HA status: FW-A is Suspended / FW-B is Active
  • FW-A install 9.1.x then reboot.
  • When FW-A is back up, verify version is 9.1.x, HA status: FW-A is Passive/ FW-B is Active.
  • Suspend FW-B, check HA status: FW-A is Active  / FW-B is Suspended.
  • FW-B install 9.1.x then reboot.
  • When FW-B is back up, verify version is 9.1.x, HA status: FW-A is Active / FW-B is Passive.
  • ======Upgrade to 10.0.x=========
  • FW-A, download 10.0 (synch to peer), No install, download 10.0.x  (synch to peer)
  • Suspend FW-A, check HA status: FW-A is Suspended / FW-B is Active
  • FW-A install 10.0.x then reboot.
  • When FW-A is back up, verify version is 10.0.x, HA status: FW-A is Passive / FW-B is Active.
  • Suspend FW-B, check HA status: FW-A is Active/ FW-B is Suspended.
  • FW-B install 10.0.x then reboot
  • When FW-B is back up, verify version is 10.0.x, HA status: FW-A is Active / FW-B is Passive.
  • ======Upgrade to 10.1.x=========
  • FW-A, download 10.1 (synch to peer), No install, download 10.1.x  (synch to peer).
  • Suspect FW-A,  check HA status: FW-A is Suspended / FW-B is Active.
  • FW-A install 10.1.x then reboot.
  • When FW-A is back up, verify version is 10.1.x, HA status: FW-A is Active/ FW-B is Non-functional (version mismatch).
  • FW-B install 10.1.x then reboot
  • When FW-B is back up, verify version is 10.1.x, HA status: FW-A is Active / FW-B is Passive.
  • ======Upgrade to 10.2.0===============
    for some reason, download 10.2.0 then download 10.2.x cause both downloaded images disappear.
  • FW-A download 10.2.0  (synch to peer)
  • Suspect FW-A,  check HA status: FW-A is Suspended / FW-B is Active.
  • FW-A install 10.2.0 then reboot.
  • When FW-A is back up, verify version is 10.2.0, HA status: FW-A is Passive / FW-B is Active.
  • Suspend FW-B,  check HA status: FW-A is Active/ FW-B is Suspended.
  • FW-B, install 10.2.0 then reboot.
  • When FW-B is back up, verify version is 10.2.0, HA status: FW-A is Active / FW-B is Passive
  • ======Upgrade to 10.2.x===============
  • FW-A download 10.2.x  (synch to peer)
  • Suspect FW-A,  check HA status: FW-A is Suspended / FW-B is Active.
  • FW-A install 10.2.x then reboot.
  • When FW-A is back up, verify version is 10.2.x, HA status: FW-A is Passive / FW-B is Active.
  • Suspend FW-B,  check HA status: FW-A is Active/ FW-B is Suspended.
  • FW-B, install 10.2.x then reboot.
  • When FW-B is back up, verify version is 10.2.x, HA status: FW-A is Active / FW-B is Passive
  • FW-A, enable preemptive, submit the change.






Upgrade from CLI

it is recommended to bring your current Feature release to the latest recommended maintenance release before proceeding next Feature release.

1. Current is 9.1.6, download 9.1.11 image:







2. Put the image on SCP or TFTP server which can be accessed from PA MGMT.

3. If use SCP:
admin@PA-VM> scp import software from admin@172.16.1.10:/PanOS_vm-9.1.11
The authenticity of host '172.16.1.10 (172.16.1.10)' can't be established.
RSA key fingerprint is 80:b7:bb:06:c6:b9:ed:20:a4:7b:d0:49:b1:e9:15:35.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '172.16.1.10' (RSA) to the list of known hosts.
admin@172.16.1.10's password:
PanOS_vm-9.1.11                                                              88%  353MB  20.9MB/s   00:02 ETA

PanOS_vm-9.1.11 saved

admin@PA-VM>

4. Install the new image
admin@PA-VM> request system software install version
  9.1.11   9.1.11
  <value>  Upgrade to a software package by version

admin@PA-VM> request system software install version 9.1.11
Executing this command will install a new version of software. It will not take effect until system is restarted. Do you want to continue? (y or n)

Software install job enqueued with jobid 3. Run 'show jobs id 3' to monitor its status. Please reboot the device after the installation is done.
3

admin@PA-VM> 
admin@PA-VM> show jobs id 3

Enqueued              Dequeued           ID                              Type                         Status Result Completed
------------------------------------------------------------------------------------------------------------------------------
2021/09/22 09:40:35   09:40:35            3                         SWInstall                            ACT   PEND        0%
Warnings:
Details:Loading into software manager



admin@PA-VM> show jobs id 3

Enqueued              Dequeued           ID                              Type                         Status Result Completed
------------------------------------------------------------------------------------------------------------------------------
2021/09/22 09:40:35   09:40:35            3                         SWInstall                            ACT   PEND        54%
Warnings:
Details:Loading into software manager
Successfully loaded image into software manager

admin@PA-VM> show jobs id 3

Enqueued              Dequeued           ID                              Type                         Status Result Completed
------------------------------------------------------------------------------------------------------------------------------
2021/09/22 09:40:35   09:40:35            3                         SWInstall                            FIN     OK 09:50:50
Warnings:
Details:Loading into software manager
Successfully loaded image into software manager
Software installation successfully completed. Please reboot to switch to the new version.


==============HA Upgrade=============
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/upgrade-an-ha-firewall-pair

IMPORTANT NOTE:
When upgrading a HA Active/Passive firewall pair across multiple feature releases, for example from 9.0.14 to 10.0.7, it has to be made sure that both Firewalls in HA are upgraded to the same Feature release every time before moving on the next feature release. 
If Firewall-A has been upgrade to 9.1.x as the intermediate step, then Firewall-B also has to be upgraded to 9.1.x before Firewall-A can be upgraded to 10.0.7 
If there is more than 1 version of difference between the HA pairs,  "Peer version too old" issue will happen.

1. Disable Preempt

Lower Preempt number has higher priority

Traffic failover test must have been conducted before the start of upgrade process to make sure both Firewalls are capable of passing traffic without issues. Disable Preemption if enabled.

  • Disable Preemption on High Availability settings to avoid unexpected failover.
  • Disabling preempt configuration change must be committed on both peers.
  • Once upgrade is completed, re-enabling must be committed on both peers.

2. Auto download or Upload image to both FWs
    Device > Software



=========

https://indepthtechnology.org/2020/07/05/palo-alto-panorama-and-firewall-upgrade-procedure/


Comments

Post a Comment

Popular posts from this blog

Firepower FMC and FTD troubleshooting

-
 1. Display real time log on FMC or FTD: pigtail for example: pigtail | grep 192.168.2.20                      pigtail | grep sftunnel 2. Restart communication channel manage_procs.pl run it from  the sensor only, run it from FMC will reset all sensors' channel. This scripts are nice to be used when the FMC and FTD have communication problems like heartbeats are not received, policy deployment is failing or events are not received > expert ************************************************************** NOTICE - Shell access will be deprecated in future releases          and will be replaced with a separate expert mode CLI. ************************************************************** admin@FTD:~$ sudo su Password: root@FTD:/home/admin# manage_procs.pl ****************  Configuration Utility  **************  1   Reconfigure Correlator  2   Reconfigure and flush Correlator  3    Restart Comm. channel  4   Update routes  5   Reset all routes  6   Validate Network  0   Exit *****
Read more

ASA IKEv1 VPN troubleshooting Steps and Tips

-
  1. Phase I proposal mismatch  Run show crypto isakmp sa  Initiator: MM_WAIT_MSG2 Responder: No info  Most likely this is phase1 proposal mismatch, verify IKEv1 policy, other symptoms:   Initiator log: Information Exchange processing failed All configured IKE versions failed to establish the tunnel Initiator debug: Received an un-encrypted NO_PROPOSAL_CHOSEN notify message, dropping Responder log: Error processing payload: Payload ID Responder debug:  All SA proposals found unacceptable 2. IKE version mismatch:  Run  show crypto isakmp sa  no info at both initiator and responder Initiator log: Removing peer from correlator table failed, no match! Reason: User Requested  All configured IKE versions failed to establish the tunnel Initiator debug: Oakley begin quick mode PHASE 1 COMPLETED IKE Initiator sending 1st QM pkt Removing peer from correlator table failed, no match! Session is being torn down. Reason: User Requested Responder log: Tunnel Rejected: Conflicting protocols specified
Read more

Firepower 2100/1100 FTD/ASA initial setup, reimage, upgrade.

-
  Chassis FXOS and FTD share same management IP (default 192.168.45.45) Chassis FXOS (192.168.45.45) and ASA ()use different management IP although on same physical interface. SSH to FXOS/FTD are on FTD CLI prompt, go to FXOS using the  connect fxos  command Console to Chassis is on FXOS CLI prompt, go to FTD using the  connect ftd  command The Firepower 1100 does not support the FXOS Firepower Chassis Manager; only a limited CLI is supported for troubleshooting purposes. The Firepower 2100 runs an underlying operating system called the Firepower eXtensible Operating System (FXOS).  If you run ASA on Firepower 2100, ASA can be in the following modes: Appliance mode (the default after ASA 9.13)—Appliance mode lets you configure all settings in the ASA. Only advanced troubleshooting commands are available from the FXOS CLI. See the  FXOS troubleshooting guide  for more information. Firepower Chassis Manager is not supported . ciscoasa# connect fxos [admin] Connecting to fxos. Connected
Read more