🔧 Palo Alto HA Firmware Upgrade (GUI-Focused)

Phase 0 — Preconditions

Navigate to:

Dashboard

Check:

  • Both firewalls visible
  • No critical alerts

Then:

Device > High Availability > General

Verify:

  • State = Active / Passive
  • Config Sync = Synchronized
  • Peer = Connected

If not healthy → stop. Fix HA first.

Phase 1 — Backup both firewalls

On each firewall:

Device > Setup > Operations

Perform:

  • Save named configuration snapshot
  • Export named configuration snapshot
  • Export device state

Phase 2 — Validate Upgrade Path (CRITICAL)

Navigate to:

Device > Software

Click:

Check Now

🔴 Example: Large Major Version Upgrade

Current version:

PAN-OS 9.1.15

Target version:

PAN-OS 11.1.13-h3

❌ Wrong approach

9.1 → 11.1 (NOT allowed)

✅ Correct upgrade sequence

9.1.15
 ↓
10.0.0 → 10.0.x
 ↓
10.1.0 → 10.1.x
 ↓
10.2.0 → 10.2.x
 ↓
11.0.0 → 11.0.x
 ↓
11.1.0 → 11.1.13-h3

How to execute this in GUI

For each step:

Device > Software
  1. Click Check Now
  2. Download base version (e.g. 10.0.0)
  3. Install
  4. Reboot
  5. Repeat

Important behavior

  • Intermediate versions must be installed to unlock next versions
  • Every major upgrade requires reboot
  • Always go base (.0) → stable (.x)

HA-specific execution

Passive firewall:
  Perform full upgrade chain

Failover

Second firewall:
  Repeat same chain

Time expectation

1–2 hours per firewall

Phase 3 — Update dynamic content

Navigate to:

Device > Dynamic Updates

Update:

  • Applications and Threats
  • Antivirus
  • WildFire
  • URL Filtering

Phase 4 — Disable preemption

Device > High Availability > Election Settings
  • Uncheck Preemptive
  • Commit

Phase 5 — Upgrade PASSIVE firewall

Identify passive:

Dashboard > High Availability Widget

Then:

Device > Software

Steps:

  • Check Now
  • Download
  • Install
  • Reboot

Phase 6 — Validate passive firewall

Device > High Availability
  • State = Passive
  • Sync = Synchronized

Phase 7 — Force failover

Device > High Availability > Operational Commands

Click:

Suspend local device

Phase 8 — Validate failover

Check:

Monitor > Traffic
Network > IPSec Tunnels

If broken → stop.

Phase 9 — Upgrade second firewall

Repeat upgrade steps.

Phase 10 — Restore HA

Device > High Availability > Operational Commands

Click:

Make local device functional

Phase 11 — Re-enable preemption (optional)

Device > High Availability > Election Settings

Phase 12 — Final validation

Check:

  • HA status
  • Traffic logs
  • VPN tunnels
  • Routing
  • System logs

🧠 CLI Alternative (Condensed)

show high-availability state

request system software check
request system software download version <version>
request system software install version <version>
request restart system

request high-availability state suspend

# upgrade second firewall

request high-availability state functional

show system info
show vpn ipsec-sa

=========================

🔽 ADD-ON ADVANCED GUIDES

=========================

🟢 ADD-ON 1: Near Zero-Downtime Strategy

Requirements

Device > High Availability > General
  • Session Sync = Enabled
  • HA2 link up

Validate

show high-availability state
show session info

Mandatory failover test

Device > High Availability > Operational Commands
Suspend local device

VPN considerations

Network > IPSec Tunnels
  • Enable monitoring
  • Enable DPD

Reality

Traffic Impact
Web Minimal
DB/RDP Reset possible
IPsec Reconnect
SSL VPN Disconnect

🧭 ADD-ON 2: Panorama Upgrade

Using Palo Alto Panorama

Steps

Panorama > Device Deployment > Dynamic Updates

Panorama > Managed Devices (check sync)

Panorama > Device Deployment > Software
  • Upgrade passive first
  • Manual failover
  • Upgrade second

Warning

Panorama does not enforce safe HA sequencing.

🔥 ADD-ON 3: Rollback Procedure

Fast recovery

Suspend upgraded firewall

Revert firmware

Device > Software → Install previous version

Restore config

Device > Setup > Operations
Load named configuration snapshot

CLI rollback

request system software install version <previous-version>
request restart system

Reality

Avoid:

.x.0 releases

Use:

h2 / h3 or later

Final Assessment

If you didn’t:

  • Validate HA
  • Test failover
  • Plan upgrade path
  • Prepare rollback

Then this is not a controlled upgrade.

It’s a scheduled outage waiting to happen