158
•
Panorama
6.1
Administrator’s
Guide
©
Palo
Alto
Networks,
Inc.
Deploy
Updates
to
Devices
Using
Panorama
Manage
Licenses
and
Updates
Step
7
Upload
PAN
‐
OS
software
updates.
1.
Select
Panorama > Device Deployment > Software
.
2.
C
lick
Upload
,
Browse
to
the
update
file,
and
click
OK
.
Step
8
Install
PAN
‐
OS
software
updates.
To
avoid
downtime
when
updating
the
software
on
high
availability
(HA)
firewalls,
update
one
HA
peer
at
a
time.
For
active/active
firewalls,
it
doesn’t
matter
which
peer
you
update
first.
For
active/passive
firewalls,
you
must
update
the
passive
peer
first,
suspend
the
active
peer
(fail
over),
update
the
active
peer,
and
then
return
the
active
peer
to
a
functional
state
(fail
back).
Perform
the
steps
that
apply
to
your
firewall
deployment.
Remember
that
rebooting
is
necessary
only
for
certain
update
versions
within
the
upgrade
path
(see
).
•
Non
‐
HA
firewalls
—Click
Install From File
,
select
the
File Name
of
the
update
you
just
uploaded,
select
all
the
firewalls
you
are
upgrading,
select
Reboot device after install
,
and
click
OK
.
•
Active/active
HA
firewalls:
a.
Click
Install From File
,
select
the
File Name
of
the
update
you
just
uploaded,
clear
Group HA Peers
,
select
either
HA
peer,
select
Reboot device after install
,
and
click
OK
.
Wait
for
the
firewall
to
finish
rebooting
before
proceeding.
b.
Click
Install From File
,
select
the
File Name
of
the
update
you
just
uploaded,
clear
Group HA Peers
,
select
the
HA
peer
that
you
didn’t
update
yet,
select
Reboot device after
install
,
and
click
OK
.
•
Active/passive
HA
firewalls
—In
this
example,
the
active
firewall
is
named
fw1
and
the
passive
firewall
is
named
fw2:
a.
Click
Install From File
,
select
the
File Name
of
the
update
you
just
uploaded,
clear
Group HA Peers
,
select
fw2,
select
Reboot device after install
,
and
click
OK
.
Wait
for
fw2
to
finish
rebooting
before
proceeding.
b.
Access
fw1,
select
Device > High Availability > Operational
Commands
,
and
click
Suspend local device
.
c.
Access
fw2
and,
on
the
Dashboard
,
High Availability
widget,
verify
that
the
Local
firewall
state
is
active
and
the
Peer
firewall
is
suspended
.
d.
Access
Panorama,
select
Panorama > Device Deployment >
Software
,
click
Install From File
,
select
the
File Name
of
the
update
you
just
uploaded,
clear
Group HA Peers
,
select
fw1,
select
Reboot device after install
,
and
click
OK
.
Wait
for
fw1
to
finish
rebooting
before
proceeding.
e.
Access
fw1,
select
Device > High Availability > Operational
Commands
,
and
click
Make local device functional
.
Wait
two
minutes
before
proceeding.
f.
On
fw1,
select
the
Dashboard
tab
and,
in
the
High
Availability
widget,
verify
that
the
Local
firewall
state
is
active
and
the
Peer
firewall
is
passive
.
Step
9
Verify
the
software
and
content
versions
that
are
installed
on
each
managed
firewall.
1.
Select
Panorama > Managed Devices
.
2.
Locate
the
firewall
and
review
the
values
in
the
Software
Version,
Apps
and
Threat,
Antivirus,
URL
Filtering,
and
GlobalProtect
Client
columns.
Deploy
an
Update
to
Firewalls
when
Panorama
is
not
Internet
‐
connected
(Continued)
