in this video I will show you how you can update to Palo Alto firewalls configure
it as an H a pair of course you can use the principles here to upgrade standalone
firewalls - there are a few quick things you need to do before beginning your upgrade first
make sure you've got your licensing in order you'll need that to update
now select the version you want to upgrade to I recommend 8.1 release like 8.1 or 9.1
these are long-term releases that will be supported the longest also check out the
end-of-life announcements to make sure the version you want to use is still supported
I'll put a link for that in the description don't forget to read the release notes for the
version you select to make sure you understand if it will change anything in your environment
and finally check the upgrade path Palo Alto requires that you go through all the major
versions if you have 8.0 for example you would need to go to 8.1 then 9.0 then 9.1 and always
update to the base release of each major version first that is a dot 1.09 dot 0 dot 0 and so on
okay that's enough planning let's get started step one we need to check that the applications
and threats up-to-date this is really simple go to device then dynamic updates click check now
if there are any updates download them and sync the update to the Pierre
some of these processes are a bit slow so I'm speeding some up to save time
done install the update on the local firewall and appear
we repeat this process to update wildfire as well
step two we need to protect us taking a backup this is under device setup and operations
I'm exporting a named configuration snapshot and selecting running config if something goes
wrong we can just import this file again step 3 is where hae gets involved we need
to disable preemption to stop the H a pair from trying to fail back automatically after
they reboot you might have seen this in the last video when we configured a che
step four is to actually install the update the plan is to update the passive node first
and reboot it we then make it active and repeat the process on the other firewall to do this
we'll go to device then software this may pop up in error saying that there's no information
available but we're fine with that this is a new firewall which hasn't been updated before
next we click check now to see what updates are available
want to update to the latest release in 9.1 so I will first need to download
the base release 9 1.0 notice that the base file is larger than the ones after
it it contains the full pen OS which is why it needs to be installed first
once it's finished downloading we can install it
when that's done we restart the device
of course so you don't have to wait when that's finished week login and we get this
message which confirms the update is complete we can also see the version in our dashboard widget
we will now connect to the active firewall and failover the active
role device by availability operational commands we then click suspend local device
once that's done we can run the update like we did before I'll speed this up too
now we can check the version and see that it's running nine one zero we're getting closer but
we're not there yet I'm going to update to the latest version in 9.1 which is 9.1 dot - - h1
this is the same process as before update the secondary reboot failover update the
remaining firewall and reboot it you've already seen this so I'm gonna skip past all of that
now you can see that it's complete just a couple of little tasks to
finish off with we go back to the h.a settings enable preemption and commit
we also need to restore the H a pair to the correct state for this you
can connect to the CLI and run the request high-availability state functional command
that's how you update a Palo Alto firewall AJ pair I hope you found
this useful let me know what you think in the comments below