Deployment Actions Icon

Panorama Actions for Deploying PAN-OS Images

Palo Alto Networks Panorama provides centralized management capabilities, including the deployment of PAN-OS software images to managed firewalls. When initiating a software deployment task from Panorama, administrators can choose from several distinct actions to control the process.

Available Deployment Actions

Panorama offers the following primary actions for PAN-OS software deployment:

1. Upload-only

  • Action: Panorama transfers the selected PAN-OS software image file to the managed firewall(s).
  • Result: The image file resides on the firewall's disk, ready for a future installation, but it is not installed, and the firewall is not rebooted.
  • Use Case: Staging software upgrades during low-impact periods in preparation for a scheduled maintenance window. This pre-loads the image, saving time during the actual upgrade window.

2. Upload and install

  • Action: Panorama first uploads the selected PAN-OS image to the firewall(s) and then immediately initiates the installation process for that image.
  • Result: The new software version is installed on the firewall's alternate system partition. However, the firewall **does not automatically reboot** to activate the new version. A separate reboot action is required later.
  • Use Case: Performing the time-consuming parts of the upgrade (upload and install) ahead of time or during less critical hours, allowing for a quick, scheduled reboot during a maintenance window to activate the new software.

3. Install and reboot

  • Action: Panorama instructs the firewall(s) to install a PAN-OS image that is **already present** on the device's disk (previously uploaded via "upload-only", "upload and install", or manually). After the installation completes, Panorama automatically triggers a reboot of the firewall.
  • Result: The specified, pre-existing image is installed, and the firewall reboots to run the newly installed PAN-OS version.
  • Important: This action *does not* upload the image from Panorama again; it assumes the target image is already available on the firewall.
  • Use Case: Completing the upgrade process for firewalls where the software has already been uploaded and installed (via "upload and install") or just uploaded (via "upload-only", though installing a non-installed image and rebooting is combined here). This is often the final step performed during the maintenance window.

Actions Not Directly Available

It's important to note actions that are *combinations* or *not explicitly selectable* in the deployment workflow:

  • Upload and install and reboot : While this is the outcome of performing "Upload and install" followed by a separate reboot command (or potentially "Install and reboot" on an already uploaded image), it's not a single, atomic action selectable from the Panorama deployment options list. The reboot is managed distinctly.
  • Verify and install : Panorama does not offer a combined "verify and install" action. Software verification typically involves checking checksums upon download/upload (often done automatically or manually beforehand) and assessing operational status *after* installation and reboot. It's not an integrated step *within* the install action choice itself.

✅ Summary: Panorama provides granular control over the PAN-OS deployment process with distinct actions: upload-only , upload and install , and install and reboot , allowing administrators to stage and execute upgrades according to their operational needs and maintenance schedules.