diff --git a/docs/user-guide/docker/execution.md b/docs/user-guide/docker/execution.md
index 14443f5..fa6f262 100644
--- a/docs/user-guide/docker/execution.md
+++ b/docs/user-guide/docker/execution.md
@@ -74,106 +74,75 @@ In this example we will upgrade a firewall directly by using the `firewall` argu
```console
-docker run \
--v $(pwd)/assurance:/app/assurance \
--v $(pwd)/logs:/app/logs \
--it \
-ghcr.io/cdot65/pan-os-upgrade:latest firewall -v 11.1.1 -u cdot -h houston.cdot.io
+docker run -it ghcr.io/cdot65/pan-os-upgrade firewall
+Firewall hostname or IP: lab-fw1.cdot.io
+Firewall username: officehours
Firewall password:
-Dry Run? [Y/n]:
-===================================================================
+Target version: 10.1.4
+Dry Run? [Y/n]: n
+=================================================================================================
Welcome to the PAN-OS upgrade tool
-You have selected to upgrade a single Firewall appliance.
+This script software is provided on an 'as-is' basis with no warranties, and no support provided.
-No settings.yaml file was found. Default values will be used.
-Create a settings.yaml file with 'pan-os-upgrade settings' command.
-===================================================================
-๐ houston: 007954000123453 192.168.255.211
-๐ houston: HA mode: disabled
-๐ houston: Current version: 10.1.3
-๐ houston: Target version: 11.1.1
-โ
houston: Upgrade required from 10.1.3 to 11.1.1
-๐ง houston: Refreshing list of available software versions
-โ
houston: version 11.1.1 is available for download
-โ houston: Base image for 11.1.1 is not downloaded. Attempting download.
-๐ houston: version 11.1.0 is not on the target device
-๐ houston: version 11.1.0 is beginning download
-Device 007954000123453 downloading version: 11.1.0
-๐ง houston: Downloading version 11.1.0 - Elapsed time: 3 seconds
-๐ง houston: Downloading version 11.1.0 - Elapsed time: 37 seconds
-๐ง houston: Downloading version 11.1.0 - Elapsed time: 69 seconds
-๐ง houston: Downloading version 11.1.0 - Elapsed time: 102 seconds
-๐ง houston: Downloading version 11.1.0 - Elapsed time: 134 seconds
-โ
houston: 11.1.0 downloaded in 167 seconds
-โ
houston: Base image 11.1.0 downloaded successfully
-โ
houston: Pausing for 60 seconds to let 11.1.0 image load into the software manager before downloading 11.1.1
-๐ houston: Current version: 10.1.3
-๐ houston: Target version: 11.1.1
-โ
houston: Upgrade required from 10.1.3 to 11.1.1
-๐ง houston: Refreshing list of available software versions
-โ
houston: version 11.1.1 is available for download
-โ
houston: Base image for 11.1.1 is already downloaded
-๐ houston: Performing test to see if 11.1.1 is already downloaded.
-๐ houston: version 11.1.1 is not on the target device
-๐ houston: version 11.1.1 is beginning download
-Device 007954000123453 downloading version: 11.1.1
-๐ง houston: Downloading version 11.1.1 - Elapsed time: 6 seconds
-๐ง houston: Downloading version 11.1.1 - Elapsed time: 40 seconds
-๐ง houston: Downloading version 11.1.1 - Elapsed time: 74 seconds
-โ
houston: 11.1.1 downloaded in 110 seconds
-โ
houston: version 11.1.1 has been downloaded.
-๐ houston: Performing snapshot of network state information.
-๐ houston: Attempting to capture network state snapshot (Attempt 1 of 3).
-โ
houston: Network snapshot created successfully on attempt 1.
-๐พ houston: Network state snapshot collected and saved to assurance/snapshots/houston/pre/2024-02-04_09-19-25.json
-๐ houston: Performing readiness checks to determine if firewall is ready for upgrade.
-โ
houston: Passed Readiness Check: Check if active support is available
-๐จ houston: Skipped Readiness Check: Check if a given ARP entry is available in the ARP table
-โ
houston: Passed Readiness Check: Check if there are pending changes on device
-๐จ houston: Skipped Readiness Check: Check if the certificates' keys meet minimum size requirements
-๐จ houston: Skipped Readiness Check: Running Latest Content Version
-โ
houston: Passed Readiness Check: Check if any Dynamic Update job is scheduled to run within the specified time window
-โ
houston: Passed Readiness Check: No Expired Licenses
-โ
houston: Passed Readiness Check: Check if a there is enough space on the `/opt/panrepo` volume for downloading an PanOS image.
-๐จ houston: Skipped Readiness Check: Checks HA pair status from the perspective of the current device
-๐จ houston: Skipped Readiness Check: Check if a given IPsec tunnel is in active state
-๐จ houston: Skipped Readiness Check: Check for any job with status different than FIN
-๐จ houston: Skipped Readiness Check: Check if NTP is synchronized
-๐จ houston: Skipped Readiness Check: Check if the clock is synchronized between dataplane and management plane
-โ
houston: Passed Readiness Check: Check connectivity with the Panorama appliance
-๐จ houston: Skipped Readiness Check: Check if a critical session is present in the sessions table
-โ
houston: Readiness Checks completed
-๐ houston: Performing backup of configuration to local filesystem.
-๐ houston: Not a dry run, continue with upgrade.
-๐ houston: Performing upgrade to version 11.1.1.
-๐ houston: The install will take several minutes, check for status details within the GUI.
-๐ houston: Attempting upgrade to version 11.1.1 (Attempt 1 of 3).
-Device 007954000123453 installing version: 11.1.1
-โ houston: Upgrade error: Device 007954000123453 attempt to install version 11.1.1 failed: ['Failed to install 11.1.1 with the following errors.\nSW version is 11.1.1\nThe software manager is currently in use. Please try again later.\nFailed to install version 11.1.1 type panos\n\n']
-๐ง houston: Software manager is busy. Retrying in 60 seconds.
-๐ houston: Attempting upgrade to version 11.1.1 (Attempt 2 of 3).
-Device 007954000123453 installing version: 11.1.1
-โ
houston: Upgrade completed successfully
-๐ houston: Rebooting the target device.
-๐ houston: Command succeeded with no output
-๐ง houston: Retry attempt 1 due to error: URLError: reason: [Errno 60] Operation timed out
-๐ง houston: Retry attempt 2 due to error: URLError: reason: [Errno 60] Operation timed out
-๐ง houston: Retry attempt 3 due to error: URLError: reason: [Errno 61] Connection refused
-๐ง houston: Retry attempt 4 due to error: URLError: reason: [Errno 61] Connection refused
-๐ง houston: Retry attempt 5 due to error: URLError: reason: [Errno 61] Connection refused
-๐ง houston: Retry attempt 6 due to error: URLError: code: 403 reason: API Error: Invalid Credential
-๐ง houston: Retry attempt 7 due to error: URLError: code: 403 reason: API Error: Invalid Credential
-๐ง houston: Retry attempt 8 due to error: URLError: code: 403 reason: API Error: Invalid Credential
-๐ houston: Current device version: 11.1.1
-โ
houston: Device rebooted to the target version successfully.
-๐ houston: Performing backup of configuration to local filesystem.
-๐ง houston: Waiting for the device to become ready for the post upgrade snapshot.
-๐ houston: Performing snapshot of network state information.
-๐ houston: Attempting to capture network state snapshot (Attempt 1 of 3).
-โ
houston: Network snapshot created successfully on attempt 1.
-๐พ houston: Network state snapshot collected and saved to assurance/snapshots/houston/post/2024-02-04_09-44-21.json
-๐พ houston: Snapshot comparison PDF report saved to assurance/snapshots/houston/diff/2024-02-04_09-44-25_report.pdf
+The selected `firewall` subcommand will upgrade a single Firewall appliance.
+
+Settings: Custom configuration loaded file detected and loaded at:
+/app/settings.yaml
+=================================================================================================
+๐ lab-fw1.cdot.io: Connection to the appliance successful.
+๐ lab-fw1: 007054000654320 192.168.255.11
+๐ lab-fw1: HA mode: disabled
+๐ lab-fw1: Current version: 10.1.3-h3
+๐ lab-fw1: Target version: 10.1.4
+โ
lab-fw1: Upgrade required from 10.1.3-h3 to 10.1.4
+๐ง lab-fw1: Refreshing list of available software versions
+โ
lab-fw1: version 10.1.4 is available for download
+โ
lab-fw1: Base image for 10.1.4 is already downloaded
+๐ lab-fw1: Performing test to see if 10.1.4 is already downloaded.
+โ
lab-fw1: version 10.1.4 already on target device.
+โ
lab-fw1: version 10.1.4 has been downloaded.
+๐ lab-fw1: Performing snapshot of network state information.
+๐ lab-fw1: Attempting to capture network state snapshot (Attempt 1 of 3).
+โ
lab-fw1: Network snapshot created successfully on attempt 1.
+๐พ lab-fw1: Network state snapshot collected and saved to assurance/snapshots/lab-fw1/pre/2024-02-25_11-38-57.json
+๐ lab-fw1: Performing readiness checks of target firewall.
+๐ lab-fw1: Performing readiness checks to determine if firewall is ready for upgrade.
+โ
lab-fw1: Passed Readiness Check: Check if active support is available
+๐จ lab-fw1: Skipped Readiness Check: Check if a given ARP entry is available in the ARP table
+โ
lab-fw1: Passed Readiness Check: Check if there are pending changes on device
+๐จ lab-fw1: Skipped Readiness Check: Check if the certificates' keys meet minimum size requirements
+๐จ lab-fw1: Skipped Readiness Check: Running Latest Content Version
+โ
lab-fw1: Passed Readiness Check: Check if any Dynamic Update job is scheduled to run within the specified time window
+โ
lab-fw1: Passed Readiness Check: No Expired Licenses
+๐จ lab-fw1: Skipped Readiness Check: Check if a there is enough space on the `/opt/panrepo` volume for downloading an PanOS image.
+๐จ lab-fw1: Skipped Readiness Check: Checks HA pair status from the perspective of the current device
+๐จ lab-fw1: Skipped Readiness Check: Check if a given IPsec tunnel is in active state
+๐จ lab-fw1: Skipped Readiness Check: Check for any job with status different than FIN
+๐จ lab-fw1: Skipped Readiness Check: Check if NTP is synchronized
+๐จ lab-fw1: Skipped Readiness Check: Check if the clock is synchronized between dataplane and management plane
+โ
lab-fw1: Passed Readiness Check: Check connectivity with the Panorama appliance
+๐จ lab-fw1: Skipped Readiness Check: Check if a critical session is present in the sessions table
+โ
lab-fw1: Readiness Checks completed
+๐ lab-fw1: Performing backup of configuration to local filesystem.
+๐ lab-fw1: Not a dry run, continue with upgrade.
+๐ lab-fw1: Performing upgrade to version 10.1.4.
+๐ lab-fw1: The install will take several minutes, check for status details within the GUI.
+๐ lab-fw1: Attempting upgrade to version 10.1.4 (Attempt 1 of 3).
+Device 007054000654320 installing version: 10.1.4
+โ
lab-fw1: Upgrade completed successfully
+๐ lab-fw1: Rebooting the target device.
+๐ง lab-fw1: Retry attempt 1 due to error: URLError: reason: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1000)
+๐ง lab-fw1: Retry attempt 2 due to error: URLError: reason: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1000)
+๐ง lab-fw1: Retry attempt 3 due to error: URLError: reason: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1000)
+๐ง lab-fw1: Retry attempt 4 due to error: URLError: reason: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1000)
+๐ง lab-fw1: Retry attempt 5 due to error: URLError: reason: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1000)
+๐ง lab-fw1: Retry attempt 6 due to error: URLError: reason: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1000)
+๐ง lab-fw1: Retry attempt 7 due to error: URLError: reason: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1000)
+๐ lab-fw1: Current device version: 10.1.4
+โ
lab-fw1: Device rebooted to the target version successfully.
+๐ lab-fw1: Performing backup of configuration to local filesystem.
+๐ง lab-fw1: Waiting for the device to become ready for the post upgrade snapshot.
```
@@ -211,12 +180,13 @@ In the context of the `pan-os-upgrade` application, it's important to distinguis
The following are the main commands (CLI arguments) for the `pan-os-upgrade` application, each tailored for specific upgrade scenarios:
-| CLI Argument | Description |
-| ------------ | --------------------------------------------------------------------------------------------------------- |
-| `firewall` | Targets an individual firewall for upgrade. |
-| `panorama` | Targets an individual Panorama appliance for upgrade. |
-| `batch` | Utilizes a Panorama appliance to orchestrate bulk upgrades of managed firewalls. |
-| `settings` | Creates a `settings.yaml` that will allow users to customize the script's default settings and behaviors. |
+| CLI Argument | Description |
+| ------------ | ------------------------------------------------------------------------------------------------------------ |
+| `firewall` | Targets an individual firewall for upgrade. |
+| `panorama` | Targets an individual Panorama appliance for upgrade. |
+| `batch` | Utilizes a Panorama appliance to orchestrate bulk upgrades of managed firewalls. |
+| `inventory` | Creates an `inventory.yaml` that will allow users to select firewall devices that are connected to Panorama. |
+| `settings` | Creates a `settings.yaml` that will allow users to customize the script's default settings and behaviors. |
#### CLI Options
@@ -233,205 +203,6 @@ Below are the CLI options that can be used in conjunction with the above CLI arg
Each CLI option has a specific role in tailoring the upgrade process, from defining the target device and authentication credentials to setting operational parameters like the target PAN-OS version and logging verbosity.
-## Interacting with the Docker Container
-
-The container runs interactively, prompting you for details like IP address, username, password, and target PAN-OS version. If connecting to firewalls through Panorama as a proxy, you will also be prompted to provide a `--filter` option to specify the criteria for selecting the managed firewalls to upgrade.
-
-
-
-```console
-$ docker run \
--v $(pwd)/assurance:/app/assurance \
--v $(pwd)/logs:/app/logs \
--it \
-ghcr.io/cdot65/pan-os-upgrade:latest batch
-Panorama hostname or IP: panorama.cdot.io
-Panorama username: cdot
-Panorama password:
-Firewall target version (ex: 10.1.2): 10.2.7-h3
-Filter string (ex: hostname=Woodlands*) []: hostname=Woodlands*
-Dry Run? [Y/n]:
-===========================================================================
-Welcome to the PAN-OS upgrade tool
-
-You have selected to perform a batch upgrade of firewalls through Panorama.
-
-No settings.yaml file was found. Default values will be used.
-Create a settings.yaml file with 'pan-os-upgrade settings' command.
-===========================================================================
-โ
panorama.cdot.io: Connection to Panorama established. Firewall connections will be proxied!
-๐ Woodlands-fw2: 007954000987652 192.168.255.44
-๐ Woodlands-fw1: 007954000987651 192.168.255.43
-๐ Woodlands-fw2: HA mode: active
-๐ Woodlands-fw1: HA mode: passive
-๐ Woodlands-fw2: Local state: active, Local version: 10.1.3, Peer version: 10.1.3
-๐ Woodlands-fw2: Version comparison: equal
-๐ Woodlands-fw2: Detected active target device in HA pair running the same version as its peer. Added target device to revisit list.
-๐ Woodlands-fw1: Local state: passive, Local version: 10.1.3, Peer version: 10.1.3
-๐ Woodlands-fw1: Version comparison: equal
-๐ Woodlands-fw1: Target device is passive
-๐ Woodlands-fw1: Current version: 10.1.3
-๐ Woodlands-fw1: Target version: 10.2.7-h3
-โ
Woodlands-fw1: Upgrade required from 10.1.3 to 10.2.7-h3
-๐ง Woodlands-fw1: Refreshing list of available software versions
-โ
Woodlands-fw1: version 10.2.7-h3 is available for download
-โ Woodlands-fw1: Base image for 10.2.7-h3 is not downloaded. Attempting download.
-๐ Woodlands-fw1: version 10.2.0 is not on the target device
-๐ Woodlands-fw1: version 10.2.0 is beginning download
-Device 007954000987651 downloading version: 10.2.0
-๐ง Woodlands-fw1: Downloading version 10.2.0 - HA will sync image - Elapsed time: 3 seconds
-๐ง Woodlands-fw1: Downloading version 10.2.0 - HA will sync image - Elapsed time: 35 seconds
-๐ง Woodlands-fw1: Downloading version 10.2.0 - HA will sync image - Elapsed time: 66 seconds
-๐ง Woodlands-fw1: Downloading version 10.2.0 - HA will sync image - Elapsed time: 98 seconds
-๐ง Woodlands-fw1: Downloading version 10.2.0 - HA will sync image - Elapsed time: 129 seconds
-๐ง Woodlands-fw1: Downloading version 10.2.0 - HA will sync image - Elapsed time: 160 seconds
-๐ง Woodlands-fw1: Downloading version 10.2.0 - HA will sync image - Elapsed time: 192 seconds
-๐ง Woodlands-fw1: Downloading version 10.2.0 - HA will sync image - Elapsed time: 223 seconds
-๐ง Woodlands-fw1: Downloading version 10.2.0 - HA will sync image - Elapsed time: 257 seconds
-๐ง Woodlands-fw1: Downloading version 10.2.0 - HA will sync image - Elapsed time: 289 seconds
-โ
Woodlands-fw1: 10.2.0 downloaded in 321 seconds
-โ
Woodlands-fw1: Base image 10.2.0 downloaded successfully
-โ
Woodlands-fw1: Pausing for 60 seconds to let 10.2.0 image load into the software manager before downloading 10.2.7-h3
-๐ Woodlands-fw1: Current version: 10.1.3
-๐ Woodlands-fw1: Target version: 10.2.7-h3
-โ
Woodlands-fw1: Upgrade required from 10.1.3 to 10.2.7-h3
-๐ง Woodlands-fw1: Refreshing list of available software versions
-โ
Woodlands-fw1: version 10.2.7-h3 is available for download
-โ
Woodlands-fw1: Base image for 10.2.7-h3 is already downloaded
-๐ Woodlands-fw1: Performing test to see if 10.2.7-h3 is already downloaded.
-๐ Woodlands-fw1: version 10.2.7-h3 is not on the target device
-๐ Woodlands-fw1: version 10.2.7-h3 is beginning download
-Device 007954000987651 downloading version: 10.2.7-h3
-๐ง Woodlands-fw1: Downloading version 10.2.7-h3 - HA will sync image - Elapsed time: 3 seconds
-๐ง Woodlands-fw1: Downloading version 10.2.7-h3 - HA will sync image - Elapsed time: 35 seconds
-๐ง Woodlands-fw1: Downloading version 10.2.7-h3 - HA will sync image - Elapsed time: 67 seconds
-๐ง Woodlands-fw1: Downloading version 10.2.7-h3 - HA will sync image - Elapsed time: 103 seconds
-๐ง Woodlands-fw1: Downloading version 10.2.7-h3 - HA will sync image - Elapsed time: 135 seconds
-๐ง Woodlands-fw1: Downloading version 10.2.7-h3 - HA will sync image - Elapsed time: 168 seconds
-๐ง Woodlands-fw1: Downloading version 10.2.7-h3 - HA will sync image - Elapsed time: 201 seconds
-โ
Woodlands-fw1: 10.2.7-h3 downloaded in 233 seconds
-โ
Woodlands-fw1: 10.2.7-h3 has been downloaded and sync'd to HA peer.
-๐ Woodlands-fw1: Performing snapshot of network state information.
-๐ Woodlands-fw1: Attempting to capture network state snapshot (Attempt 1 of 3).
-โ
Woodlands-fw1: Network snapshot created successfully on attempt 1.
-๐พ Woodlands-fw1: Network state snapshot collected and saved to assurance/snapshots/Woodlands-fw1/pre/2024-02-04_09-15-40.json
-๐ Woodlands-fw1: Performing readiness checks to determine if firewall is ready for upgrade.
-โ
Woodlands-fw1: Passed Readiness Check: Check if active support is available
-๐จ Woodlands-fw1: Skipped Readiness Check: Check if a given ARP entry is available in the ARP table
-โ
Woodlands-fw1: Passed Readiness Check: Check if there are pending changes on device
-๐จ Woodlands-fw1: Skipped Readiness Check: Check if the certificates' keys meet minimum size requirements
-๐จ Woodlands-fw1: Skipped Readiness Check: Running Latest Content Version
-โ
Woodlands-fw1: Passed Readiness Check: Check if any Dynamic Update job is scheduled to run within the specified time window
-โ
Woodlands-fw1: Passed Readiness Check: No Expired Licenses
-๐จ Woodlands-fw1: Skipped Readiness Check: Check if a there is enough space on the `/opt/panrepo` volume for downloading an PanOS image.
-โ
Woodlands-fw1: Passed Readiness Check: Checks HA pair status from the perspective of the current device
-๐จ Woodlands-fw1: Skipped Readiness Check: Check if a given IPsec tunnel is in active state
-๐จ Woodlands-fw1: Skipped Readiness Check: Check for any job with status different than FIN
-๐จ Woodlands-fw1: Skipped Readiness Check: Check if NTP is synchronized
-๐จ Woodlands-fw1: Skipped Readiness Check: Check if the clock is synchronized between dataplane and management plane
-โ
Woodlands-fw1: Passed Readiness Check: Check connectivity with the Panorama appliance
-๐จ Woodlands-fw1: Skipped Readiness Check: Check if a critical session is present in the sessions table
-โ
Woodlands-fw1: Readiness Checks completed
-๐ Woodlands-fw1: Checking if HA peer is in sync.
-โ
Woodlands-fw1: HA peer sync test has been completed.
-๐ Woodlands-fw1: Performing backup of configuration to local filesystem.
-๐ Woodlands-fw1: Not a dry run, continue with upgrade.
-๐ Woodlands-fw1: Performing upgrade to version 10.2.7-h3.
-๐ Woodlands-fw1: The install will take several minutes, check for status details within the GUI.
-๐ Woodlands-fw1: Attempting upgrade to version 10.2.7-h3 (Attempt 1 of 3).
-Device 007954000987651 installing version: 10.2.7-h3
-โ
Woodlands-fw1: Upgrade completed successfully
-๐ Woodlands-fw1: Rebooting the target device.
-๐ Woodlands-fw1: Command succeeded with no output
-๐ง Woodlands-fw1: Retry attempt 1 due to error: 007954000987651 not connected
-๐ง Woodlands-fw1: Retry attempt 2 due to error: 007954000987651 not connected
-๐ง Woodlands-fw1: Retry attempt 3 due to error: 007954000987651 not connected
-๐ง Woodlands-fw1: Retry attempt 4 due to error: 007954000987651 not connected
-๐ง Woodlands-fw1: Retry attempt 5 due to error: 007954000987651 not connected
-๐ง Woodlands-fw1: Retry attempt 6 due to error: 007954000987651 not connected
-๐ง Woodlands-fw1: Retry attempt 7 due to error: 007954000987651 not connected
-๐ง Woodlands-fw1: Retry attempt 8 due to error: 007954000987651 not connected
-๐ง Woodlands-fw1: Retry attempt 9 due to error: 007954000987651 not connected
-๐ Woodlands-fw1: Current device version: 10.2.7-h3
-โ
Woodlands-fw1: Device rebooted to the target version successfully.
-๐ Woodlands-fw1: Performing backup of configuration to local filesystem.
-๐ง Woodlands-fw1: Waiting for the device to become ready for the post upgrade snapshot.
-๐ Woodlands-fw1: Performing snapshot of network state information.
-๐ Woodlands-fw1: Attempting to capture network state snapshot (Attempt 1 of 3).
-โ
Woodlands-fw1: Network snapshot created successfully on attempt 1.
-๐พ Woodlands-fw1: Network state snapshot collected and saved to assurance/snapshots/Woodlands-fw1/post/2024-02-04_09-35-39.json
-๐พ Woodlands-fw1: Snapshot comparison PDF report saved to assurance/snapshots/Woodlands-fw1/diff/2024-02-04_09-35-40_report.pdf
-๐ panorama.cdot.io: Revisiting firewalls that were active in an HA pair and had the same version as their peers.
-๐ Woodlands-fw2: 007954000987652 192.168.255.44
-๐ Woodlands-fw2: HA mode: non-functional
-๐ Woodlands-fw2: Local state: non-functional, Local version: 10.1.3, Peer version: 10.2.7-h3
-Waiting for HA synchronization to complete on Woodlands-fw2. Attempt 1/3
-HA synchronization complete on Woodlands-fw2. Proceeding with upgrade.
-๐ Woodlands-fw2: Version comparison: older
-๐ Woodlands-fw2: Target device is on an older version
-๐ Woodlands-fw2: Current version: 10.1.3
-๐ Woodlands-fw2: Target version: 10.2.7-h3
-โ
Woodlands-fw2: Upgrade required from 10.1.3 to 10.2.7-h3
-๐ง Woodlands-fw2: Refreshing list of available software versions
-โ
Woodlands-fw2: version 10.2.7-h3 is available for download
-โ
Woodlands-fw2: Base image for 10.2.7-h3 is already downloaded
-๐ Woodlands-fw2: Performing test to see if 10.2.7-h3 is already downloaded.
-โ
Woodlands-fw2: version 10.2.7-h3 already on target device.
-โ
Woodlands-fw2: version 10.2.7-h3 has been downloaded.
-๐ Woodlands-fw2: Performing snapshot of network state information.
-๐ Woodlands-fw2: Attempting to capture network state snapshot (Attempt 1 of 3).
-โ
Woodlands-fw2: Network snapshot created successfully on attempt 1.
-๐พ Woodlands-fw2: Network state snapshot collected and saved to assurance/snapshots/Woodlands-fw2/pre/2024-02-04_09-36-48.json
-๐ Woodlands-fw2: Performing readiness checks to determine if firewall is ready for upgrade.
-โ
Woodlands-fw2: Passed Readiness Check: Check if active support is available
-๐จ Woodlands-fw2: Skipped Readiness Check: Check if a given ARP entry is available in the ARP table
-โ
Woodlands-fw2: Passed Readiness Check: Check if there are pending changes on device
-๐จ Woodlands-fw2: Skipped Readiness Check: Check if the certificates' keys meet minimum size requirements
-๐จ Woodlands-fw2: Skipped Readiness Check: Running Latest Content Version
-โ
Woodlands-fw2: Passed Readiness Check: Check if any Dynamic Update job is scheduled to run within the specified time window
-โ
Woodlands-fw2: Passed Readiness Check: No Expired Licenses
-๐จ Woodlands-fw2: Skipped Readiness Check: Check if a there is enough space on the `/opt/panrepo` volume for downloading an PanOS image.
-๐จ Woodlands-fw2: Skipped Readiness Check: Checks HA pair status from the perspective of the current device
-๐จ Woodlands-fw2: Skipped Readiness Check: Check if a given IPsec tunnel is in active state
-๐จ Woodlands-fw2: Skipped Readiness Check: Check for any job with status different than FIN
-๐จ Woodlands-fw2: Skipped Readiness Check: Check if NTP is synchronized
-โ
Woodlands-fw2: Passed Readiness Check: Check if the clock is synchronized between dataplane and management plane
-โ
Woodlands-fw2: Passed Readiness Check: Check connectivity with the Panorama appliance
-๐จ Woodlands-fw2: Skipped Readiness Check: Check if a critical session is present in the sessions table
-โ
Woodlands-fw2: Readiness Checks completed
-๐ Woodlands-fw2: Checking if HA peer is in sync.
-๐ง Woodlands-fw2: HA peer state is not in sync. This will be noted, but the script will continue.
-๐ Woodlands-fw2: Performing backup of configuration to local filesystem.
-๐ Woodlands-fw2: Not a dry run, continue with upgrade.
-๐ Woodlands-fw2: Performing upgrade to version 10.2.7-h3.
-๐ Woodlands-fw2: The install will take several minutes, check for status details within the GUI.
-๐ Woodlands-fw2: Attempting upgrade to version 10.2.7-h3 (Attempt 1 of 3).
-Device 007954000987652 installing version: 10.2.7-h3
-โ
Woodlands-fw2: Upgrade completed successfully
-๐ Woodlands-fw2: Rebooting the target device.
-๐ Woodlands-fw2: Command succeeded with no output
-๐ง Woodlands-fw2: Retry attempt 1 due to error: 007954000987652 not connected
-๐ง Woodlands-fw2: Retry attempt 2 due to error: 007954000987652 not connected
-๐ง Woodlands-fw2: Retry attempt 3 due to error: 007954000987652 not connected
-๐ง Woodlands-fw2: Retry attempt 4 due to error: 007954000987652 not connected
-๐ง Woodlands-fw2: Retry attempt 5 due to error: 007954000987652 not connected
-๐ง Woodlands-fw2: Retry attempt 6 due to error: 007954000987652 not connected
-๐ง Woodlands-fw2: Retry attempt 7 due to error: 007954000987652 not connected
-๐ง Woodlands-fw2: Retry attempt 8 due to error: 007954000987652 not connected
-๐ง Woodlands-fw2: Retry attempt 9 due to error: 007954000987652 not connected
-๐ Woodlands-fw2: Current device version: 10.2.7-h3
-โ
Woodlands-fw2: Device rebooted to the target version successfully.
-๐ Woodlands-fw2: Performing backup of configuration to local filesystem.
-๐ง Woodlands-fw2: Waiting for the device to become ready for the post upgrade snapshot.
-๐ Woodlands-fw2: Performing snapshot of network state information.
-๐ Woodlands-fw2: Attempting to capture network state snapshot (Attempt 1 of 3).
-โ
Woodlands-fw2: Network snapshot created successfully on attempt 1.
-๐พ Woodlands-fw2: Network state snapshot collected and saved to assurance/snapshots/Woodlands-fw2/post/2024-02-04_09-57-36.json
-๐พ Woodlands-fw2: Snapshot comparison PDF report saved to assurance/snapshots/Woodlands-fw2/diff/2024-02-04_09-57-38_report.pdf
-โ
panorama.cdot.io: Completed revisiting firewalls
-```
-
-
## `inventory` Subcommand
@@ -655,29 +426,54 @@ Example `settings.yaml` file
```yaml
concurrency:
- threads: 34
+ threads: 10
+download:
+ max_tries: 3
+ retry_interval: 60
+install:
+ max_tries: 3
+ retry_interval: 60
logging:
file_path: logs/upgrade.log
level: INFO
max_size: 10
upgrade_log_count: 10
readiness_checks:
- checks: {}
- customize: false
+ checks:
+ active_support: true
+ arp_entry_exist: false
+ candidate_config: true
+ certificates_requirements: false
+ content_version: true
+ dynamic_updates: true
+ expired_licenses: true
+ free_disk_space: true
+ ha: true
+ ip_sec_tunnel_status: true
+ jobs: false
+ ntp_sync: false
+ panorama: true
+ planes_clock_sync: true
+ session_exist: false
+ customize: true
+ disabled: false
location: assurance/readiness_checks/
reboot:
- max_tries: 4
- retry_interval: 10
+ max_tries: 30
+ retry_interval: 60
snapshots:
customize: true
+ disabled: false
location: assurance/snapshots/
+ max_tries: 3
+ retry_interval: 60
state:
- arp_table: true
+ arp_table: false
content_version: true
ip_sec_tunnels: false
- license: false
+ license: true
nics: true
- routes: true
+ routes: false
session_stats: false
timeout_settings:
command_timeout: 120
diff --git a/docs/user-guide/python/execution.md b/docs/user-guide/python/execution.md
index bd588f6..9835147 100644
--- a/docs/user-guide/python/execution.md
+++ b/docs/user-guide/python/execution.md
@@ -12,104 +12,74 @@ You can start the script interactively by simply issuing `pan-os-upgrade` from y
```console
pan-os-upgrade firewall
-Firewall hostname or IP: houston.cdot.io
-Firewall username: cdot
+Firewall hostname or IP: lab-fw1.cdot.io
+Firewall username: officehours
Firewall password:
-Target version: 11.1.1
-Dry Run? [Y/n]:
-===================================================================
+Target version: 10.1.4
+Dry Run? [Y/n]: n
+=================================================================================================
Welcome to the PAN-OS upgrade tool
-You have selected to upgrade a single Firewall appliance.
-
-No settings.yaml file was found. Default values will be used.
-Create a settings.yaml file with 'pan-os-upgrade settings' command.
-===================================================================
-๐ houston: 007954000123453 192.168.255.211
-๐ houston: HA mode: disabled
-๐ houston: Current version: 10.1.3
-๐ houston: Target version: 11.1.1
-โ
houston: Upgrade required from 10.1.3 to 11.1.1
-๐ง houston: Refreshing list of available software versions
-โ
houston: version 11.1.1 is available for download
-โ houston: Base image for 11.1.1 is not downloaded. Attempting download.
-๐ houston: version 11.1.0 is not on the target device
-๐ houston: version 11.1.0 is beginning download
-Device 007954000123453 downloading version: 11.1.0
-๐ง houston: Downloading version 11.1.0 - Elapsed time: 3 seconds
-๐ง houston: Downloading version 11.1.0 - Elapsed time: 37 seconds
-๐ง houston: Downloading version 11.1.0 - Elapsed time: 69 seconds
-๐ง houston: Downloading version 11.1.0 - Elapsed time: 102 seconds
-๐ง houston: Downloading version 11.1.0 - Elapsed time: 134 seconds
-โ
houston: 11.1.0 downloaded in 167 seconds
-โ
houston: Base image 11.1.0 downloaded successfully
-โ
houston: Pausing for 60 seconds to let 11.1.0 image load into the software manager before downloading 11.1.1
-๐ houston: Current version: 10.1.3
-๐ houston: Target version: 11.1.1
-โ
houston: Upgrade required from 10.1.3 to 11.1.1
-๐ง houston: Refreshing list of available software versions
-โ
houston: version 11.1.1 is available for download
-โ
houston: Base image for 11.1.1 is already downloaded
-๐ houston: Performing test to see if 11.1.1 is already downloaded.
-๐ houston: version 11.1.1 is not on the target device
-๐ houston: version 11.1.1 is beginning download
-Device 007954000123453 downloading version: 11.1.1
-๐ง houston: Downloading version 11.1.1 - Elapsed time: 6 seconds
-๐ง houston: Downloading version 11.1.1 - Elapsed time: 40 seconds
-๐ง houston: Downloading version 11.1.1 - Elapsed time: 74 seconds
-โ
houston: 11.1.1 downloaded in 110 seconds
-โ
houston: version 11.1.1 has been downloaded.
-๐ houston: Performing snapshot of network state information.
-๐ houston: Attempting to capture network state snapshot (Attempt 1 of 3).
-โ
houston: Network snapshot created successfully on attempt 1.
-๐พ houston: Network state snapshot collected and saved to assurance/snapshots/houston/pre/2024-02-04_09-19-25.json
-๐ houston: Performing readiness checks to determine if firewall is ready for upgrade.
-โ
houston: Passed Readiness Check: Check if active support is available
-๐จ houston: Skipped Readiness Check: Check if a given ARP entry is available in the ARP table
-โ
houston: Passed Readiness Check: Check if there are pending changes on device
-๐จ houston: Skipped Readiness Check: Check if the certificates' keys meet minimum size requirements
-๐จ houston: Skipped Readiness Check: Running Latest Content Version
-โ
houston: Passed Readiness Check: Check if any Dynamic Update job is scheduled to run within the specified time window
-โ
houston: Passed Readiness Check: No Expired Licenses
-โ
houston: Passed Readiness Check: Check if a there is enough space on the `/opt/panrepo` volume for downloading an PanOS image.
-๐จ houston: Skipped Readiness Check: Checks HA pair status from the perspective of the current device
-๐จ houston: Skipped Readiness Check: Check if a given IPsec tunnel is in active state
-๐จ houston: Skipped Readiness Check: Check for any job with status different than FIN
-๐จ houston: Skipped Readiness Check: Check if NTP is synchronized
-๐จ houston: Skipped Readiness Check: Check if the clock is synchronized between dataplane and management plane
-โ
houston: Passed Readiness Check: Check connectivity with the Panorama appliance
-๐จ houston: Skipped Readiness Check: Check if a critical session is present in the sessions table
-โ
houston: Readiness Checks completed
-๐ houston: Performing backup of configuration to local filesystem.
-๐ houston: Not a dry run, continue with upgrade.
-๐ houston: Performing upgrade to version 11.1.1.
-๐ houston: The install will take several minutes, check for status details within the GUI.
-๐ houston: Attempting upgrade to version 11.1.1 (Attempt 1 of 3).
-Device 007954000123453 installing version: 11.1.1
-โ houston: Upgrade error: Device 007954000123453 attempt to install version 11.1.1 failed: ['Failed to install 11.1.1 with the following errors.\nSW version is 11.1.1\nThe software manager is currently in use. Please try again later.\nFailed to install version 11.1.1 type panos\n\n']
-๐ง houston: Software manager is busy. Retrying in 60 seconds.
-๐ houston: Attempting upgrade to version 11.1.1 (Attempt 2 of 3).
-Device 007954000123453 installing version: 11.1.1
-โ
houston: Upgrade completed successfully
-๐ houston: Rebooting the target device.
-๐ houston: Command succeeded with no output
-๐ง houston: Retry attempt 1 due to error: URLError: reason: [Errno 60] Operation timed out
-๐ง houston: Retry attempt 2 due to error: URLError: reason: [Errno 60] Operation timed out
-๐ง houston: Retry attempt 3 due to error: URLError: reason: [Errno 61] Connection refused
-๐ง houston: Retry attempt 4 due to error: URLError: reason: [Errno 61] Connection refused
-๐ง houston: Retry attempt 5 due to error: URLError: reason: [Errno 61] Connection refused
-๐ง houston: Retry attempt 6 due to error: URLError: code: 403 reason: API Error: Invalid Credential
-๐ง houston: Retry attempt 7 due to error: URLError: code: 403 reason: API Error: Invalid Credential
-๐ง houston: Retry attempt 8 due to error: URLError: code: 403 reason: API Error: Invalid Credential
-๐ houston: Current device version: 11.1.1
-โ
houston: Device rebooted to the target version successfully.
-๐ houston: Performing backup of configuration to local filesystem.
-๐ง houston: Waiting for the device to become ready for the post upgrade snapshot.
-๐ houston: Performing snapshot of network state information.
-๐ houston: Attempting to capture network state snapshot (Attempt 1 of 3).
-โ
houston: Network snapshot created successfully on attempt 1.
-๐พ houston: Network state snapshot collected and saved to assurance/snapshots/houston/post/2024-02-04_09-44-21.json
-๐พ houston: Snapshot comparison PDF report saved to assurance/snapshots/houston/diff/2024-02-04_09-44-25_report.pdf
+This script software is provided on an 'as-is' basis with no warranties, and no support provided.
+
+The selected `firewall` subcommand will upgrade a single Firewall appliance.
+
+Settings: Custom configuration loaded file detected and loaded at:
+/app/settings.yaml
+=================================================================================================
+๐ lab-fw1.cdot.io: Connection to the appliance successful.
+๐ lab-fw1: 007054000654320 192.168.255.11
+๐ lab-fw1: HA mode: disabled
+๐ lab-fw1: Current version: 10.1.3-h3
+๐ lab-fw1: Target version: 10.1.4
+โ
lab-fw1: Upgrade required from 10.1.3-h3 to 10.1.4
+๐ง lab-fw1: Refreshing list of available software versions
+โ
lab-fw1: version 10.1.4 is available for download
+โ
lab-fw1: Base image for 10.1.4 is already downloaded
+๐ lab-fw1: Performing test to see if 10.1.4 is already downloaded.
+โ
lab-fw1: version 10.1.4 already on target device.
+โ
lab-fw1: version 10.1.4 has been downloaded.
+๐ lab-fw1: Performing snapshot of network state information.
+๐ lab-fw1: Attempting to capture network state snapshot (Attempt 1 of 3).
+โ
lab-fw1: Network snapshot created successfully on attempt 1.
+๐พ lab-fw1: Network state snapshot collected and saved to assurance/snapshots/lab-fw1/pre/2024-02-25_11-38-57.json
+๐ lab-fw1: Performing readiness checks of target firewall.
+๐ lab-fw1: Performing readiness checks to determine if firewall is ready for upgrade.
+โ
lab-fw1: Passed Readiness Check: Check if active support is available
+๐จ lab-fw1: Skipped Readiness Check: Check if a given ARP entry is available in the ARP table
+โ
lab-fw1: Passed Readiness Check: Check if there are pending changes on device
+๐จ lab-fw1: Skipped Readiness Check: Check if the certificates' keys meet minimum size requirements
+๐จ lab-fw1: Skipped Readiness Check: Running Latest Content Version
+โ
lab-fw1: Passed Readiness Check: Check if any Dynamic Update job is scheduled to run within the specified time window
+โ
lab-fw1: Passed Readiness Check: No Expired Licenses
+๐จ lab-fw1: Skipped Readiness Check: Check if a there is enough space on the `/opt/panrepo` volume for downloading an PanOS image.
+๐จ lab-fw1: Skipped Readiness Check: Checks HA pair status from the perspective of the current device
+๐จ lab-fw1: Skipped Readiness Check: Check if a given IPsec tunnel is in active state
+๐จ lab-fw1: Skipped Readiness Check: Check for any job with status different than FIN
+๐จ lab-fw1: Skipped Readiness Check: Check if NTP is synchronized
+๐จ lab-fw1: Skipped Readiness Check: Check if the clock is synchronized between dataplane and management plane
+โ
lab-fw1: Passed Readiness Check: Check connectivity with the Panorama appliance
+๐จ lab-fw1: Skipped Readiness Check: Check if a critical session is present in the sessions table
+โ
lab-fw1: Readiness Checks completed
+๐ lab-fw1: Performing backup of configuration to local filesystem.
+๐ lab-fw1: Not a dry run, continue with upgrade.
+๐ lab-fw1: Performing upgrade to version 10.1.4.
+๐ lab-fw1: The install will take several minutes, check for status details within the GUI.
+๐ lab-fw1: Attempting upgrade to version 10.1.4 (Attempt 1 of 3).
+Device 007054000654320 installing version: 10.1.4
+โ
lab-fw1: Upgrade completed successfully
+๐ lab-fw1: Rebooting the target device.
+๐ง lab-fw1: Retry attempt 1 due to error: URLError: reason: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1000)
+๐ง lab-fw1: Retry attempt 2 due to error: URLError: reason: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1000)
+๐ง lab-fw1: Retry attempt 3 due to error: URLError: reason: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1000)
+๐ง lab-fw1: Retry attempt 4 due to error: URLError: reason: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1000)
+๐ง lab-fw1: Retry attempt 5 due to error: URLError: reason: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1000)
+๐ง lab-fw1: Retry attempt 6 due to error: URLError: reason: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1000)
+๐ง lab-fw1: Retry attempt 7 due to error: URLError: reason: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1000)
+๐ lab-fw1: Current device version: 10.1.4
+โ
lab-fw1: Device rebooted to the target version successfully.
+๐ lab-fw1: Performing backup of configuration to local filesystem.
+๐ง lab-fw1: Waiting for the device to become ready for the post upgrade snapshot.
```
@@ -144,62 +114,204 @@ Examples:
โฏ pan-os-upgrade batch
Panorama hostname or IP: panorama1.cdot.io
Panorama username: officehours
-Panorama password:
+Panorama password:
Firewall target version (ex: 10.1.2): 10.1.3-h3
-Dry Run? [Y/n]:
-===========================================================================
+Dry Run? [Y/n]: n
+=================================================================================================
Welcome to the PAN-OS upgrade tool
-You have selected to perform a batch upgrade of firewalls through Panorama.
+This script software is provided on an 'as-is' basis with no warranties, and no support provided.
-Custom configuration loaded from:
-/Users/cdot/development/public/pan-os-upgrade/pan_os_upgrade/settings.yaml
+The selected `batch` subcommand will upgrade one or more firewalls.
-No inventory.yaml file was found, getting firewalls connected to Panorama.
-Create an inventory.yaml file with 'pan-os-upgrade inventory' command.
-===========================================================================
+Settings: No settings.yaml file was found, default values will be used.
+You can create a settings.yaml file with 'pan-os-upgrade settings' command.
+
+Inventory: No inventory.yaml file was found, firewalls will need be selected through the menu.
+You can create an inventory.yaml file with 'pan-os-upgrade inventory' command.
+=================================================================================================
+๐ panorama1.cdot.io: Connection to the appliance successful.
โ
panorama1.cdot.io: Connection to Panorama established. Firewall connections will be proxied!
๐ง panorama1.cdot.io: Retrieving a list of all firewalls connected to Panorama...
๐ง panorama1.cdot.io: Retrieving detailed information of each firewall...
-โโโโโโโคโโโโโโโโโโโโโคโโโโโโโโโโโโโโโโโคโโโโโโโโโโคโโโโโโโโโโโโโโโโโโคโโโโโโโโโโโโโโโคโโโโโโโโโโโโโโโโ
-โ # โ Hostname โ IP Address โ Model โ Serial โ SW Version โ App Version โ
-โโโโโโโชโโโโโโโโโโโโโชโโโโโโโโโโโโโโโโโชโโโโโโโโโโชโโโโโโโโโโโโโโโโโโชโโโโโโโโโโโโโโโชโโโโโโโโโโโโโโโโก
-โ 1 โ katy-fw1 โ 192.168.255.41 โ PA-VM โ 007954000123454 โ 10.1.3-h2 โ 8799-8509 โ
-โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโค
-โ 2 โ katy-fw2 โ 192.168.255.42 โ PA-VM โ 007954000123455 โ 10.1.3-h2 โ 8799-8509 โ
-โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโค
-โ 3 โ lab-fw1 โ 192.168.255.11 โ PA-VM โ 007954000123456 โ 10.1.3-h3 โ 8729-8157 โ
-โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโค
-โ 4 โ lab-fw2 โ 192.168.255.12 โ PA-VM โ 007954000123457 โ 10.1.3-h3 โ 8729-8157 โ
-โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโค
-โ 5 โ lab-fw3 โ 192.168.255.13 โ PA-VM โ 007954000123458 โ 10.1.3-h3 โ 8729-8157 โ
-โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโค
-โ 6 โ lab-fw4 โ 192.168.255.14 โ PA-VM โ 007954000123459 โ 10.1.3-h3 โ 8729-8157 โ
-โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโค
-โ 7 โ lab-fw5 โ 192.168.255.15 โ PA-VM โ 007954000123460 โ 10.1.3-h3 โ 8729-8157 โ
-โโโโโโโงโโโโโโโโโโโโโงโโโโโโโโโโโโโโโโโงโโโโโโโโโโงโโโโโโโโโโโโโโโโโโงโโโโโโโโโโโโโโโงโโโโโโโโโโโโโโโโ
+โโโโโโโคโโโโโโโโโโโโโคโโโโโโโโโโโโโโโโโคโโโโโโโโโโคโโโโโโโโโโโโคโโโโโโโโโโโโคโโโโโโโโโโโโคโโโโโโโโโโโโ
+โ # โ Hostname โ IP Address โ Model โ PAN-OS โ Content โ HA Mode โ Preempt โ
+โโโโโโโชโโโโโโโโโโโโโชโโโโโโโโโโโโโโโโโชโโโโโโโโโโชโโโโโโโโโโโโชโโโโโโโโโโโโชโโโโโโโโโโโโชโโโโโโโโโโโโก
+โ 1 โ katy-fw1 โ 192.168.255.41 โ PA-VM โ 10.1.3-h3 โ 8799-8509 โ passive โ no โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 2 โ katy-fw2 โ 192.168.255.42 โ PA-VM โ 10.1.3-h3 โ 8799-8509 โ active โ no โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 3 โ lab-fw1 โ 192.168.255.11 โ PA-VM โ 10.1.3 โ 8729-8157 โ disabled โ N/A โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 4 โ lab-fw2 โ 192.168.255.12 โ PA-VM โ 10.1.3 โ 8729-8157 โ disabled โ N/A โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 5 โ lab-fw3 โ 192.168.255.13 โ PA-VM โ 10.1.3 โ 8729-8157 โ disabled โ N/A โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 6 โ lab-fw4 โ 192.168.255.14 โ PA-VM โ 10.1.3 โ 8729-8157 โ disabled โ N/A โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 7 โ lab-fw5 โ 192.168.255.15 โ PA-VM โ 10.1.3 โ 8729-8157 โ disabled โ N/A โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 8 โ lab-fw6 โ 192.168.255.16 โ PA-VM โ 10.1.4-h4 โ 8729-8157 โ active โ yes โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 9 โ lab-fw7 โ 192.168.255.17 โ PA-VM โ 10.1.4-h4 โ 8729-8157 โ passive โ yes โ
+โโโโโโโงโโโโโโโโโโโโโงโโโโโโโโโโโโโโโโโงโโโโโโโโโโงโโโโโโโโโโโโงโโโโโโโโโโโโงโโโโโโโโโโโโงโโโโโโโโโโโโ
You can select devices by entering their numbers, ranges, or separated by commas.
Examples: '1', '2-4', '1,3,5-7'.
Type 'done' on a new line when finished.
-Enter your selection(s): 1,3,5-7
-katy-fw1 selected.
-lab-fw1 selected.
-lab-fw3 selected.
-lab-fw4 selected.
-lab-fw5 selected.
+Enter your selection(s): 3-4
+ - lab-fw1 selected.
+ - lab-fw2 selected.
Enter your selection(s): done
-๐ panorama1.cdot.io: Upgrading 5 devices to version 10.1.3-h3...
+๐ง panorama1.cdot.io: Selected 2 firewalls from inventory.yaml for upgrade.
+๐ panorama1.cdot.io: Upgrading 2 devices to version 10.1.3-h3...
๐ panorama1.cdot.io: Please confirm the selected firewalls:
- - katy-fw1 (192.168.255.41)
- lab-fw1 (192.168.255.11)
- - lab-fw3 (192.168.255.13)
- - lab-fw4 (192.168.255.14)
- - lab-fw5 (192.168.255.15)
-๐ง panorama1.cdot.io: Dry run mode is enabled, upgrade workflow will be skipped.
-Do you want to proceed with the dry run? [y/N]: y
+ - lab-fw2 (192.168.255.12)
+๐ง panorama1.cdot.io: Dry run mode is disabled, upgrade workflow will be executed.
+๐ panorama1.cdot.io: Do you want to proceed with the upgrade? [y/N]: y
๐ Proceeding with the upgrade...
-... shortened output for brevity ...
+๐ Proceeding with the upgrade...
+๐ง panorama1.cdot.io: Using 10 threads.
+๐ lab-fw1: 007054000654321 192.168.255.41
+๐ lab-fw2: 007054000654322 192.168.255.42
+๐ lab-fw1: HA mode: active
+๐ lab-fw2: HA mode: passive
+๐ lab-fw1: Local state: active, Local version: 10.1.3, Peer version: 10.1.3
+๐ lab-fw1: Version comparison: equal
+๐ lab-fw1: Detected active target device in HA pair running the same version as its peer. Added target device to revisit list.
+๐ lab-fw2: Local state: passive, Local version: 10.1.3, Peer version: 10.1.3
+๐ lab-fw2: Version comparison: equal
+๐ lab-fw2: Target device is passive
+๐ lab-fw2: Current version: 10.1.3
+๐ lab-fw2: Target version: 10.1.3-h3
+โ
lab-fw2: Upgrade required from 10.1.3 to 10.1.3-h3
+๐ง lab-fw2: Refreshing list of available software versions
+โ
lab-fw2: version 10.1.3-h3 is available for download
+โ
lab-fw2: Base image for 10.1.3-h3 is already downloaded
+๐ lab-fw2: Performing test to see if 10.1.3-h3 is already downloaded.
+โ
lab-fw2: version 10.1.3-h3 already on target device.
+โ
lab-fw2: 10.1.3-h3 has been downloaded and sync'd to HA peer.
+๐ lab-fw2: Performing snapshot of network state information.
+๐ lab-fw2: Attempting to capture network state snapshot (Attempt 1 of 3).
+โ
lab-fw2: Network snapshot created successfully on attempt 1.
+๐พ lab-fw2: Network state snapshot collected and saved to assurance/snapshots/lab-fw2/pre/2024-02-25_04-14-15.json
+๐ lab-fw2: Performing readiness checks of target firewall.
+๐ lab-fw2: Performing readiness checks to determine if firewall is ready for upgrade.
+โ
lab-fw2: Passed Readiness Check: Check if active support is available
+๐จ lab-fw2: Skipped Readiness Check: Check if a given ARP entry is available in the ARP table
+โ
lab-fw2: Passed Readiness Check: Check if there are pending changes on device
+๐จ lab-fw2: Skipped Readiness Check: Check if the certificates' keys meet minimum size requirements
+๐จ lab-fw2: Skipped Readiness Check: Running Latest Content Version
+โ
lab-fw2: Passed Readiness Check: Check if any Dynamic Update job is scheduled to run within the specified time window
+โ
lab-fw2: Passed Readiness Check: No Expired Licenses
+๐จ lab-fw2: Skipped Readiness Check: Check if a there is enough space on the `/opt/panrepo` volume for downloading an PanOS image.
+โ
lab-fw2: Passed Readiness Check: Checks HA pair status from the perspective of the current device
+๐จ lab-fw2: Skipped Readiness Check: Check if a given IPsec tunnel is in active state
+๐จ lab-fw2: Skipped Readiness Check: Check for any job with status different than FIN
+๐จ lab-fw2: Skipped Readiness Check: Check if NTP is synchronized
+โ
lab-fw2: Passed Readiness Check: Check if the clock is synchronized between dataplane and management plane
+โ
lab-fw2: Passed Readiness Check: Check connectivity with the Panorama appliance
+๐จ lab-fw2: Skipped Readiness Check: Check if a critical session is present in the sessions table
+โ
lab-fw2: Readiness Checks completed
+๐ lab-fw2: Checking if HA peer is in sync.
+โ
lab-fw2: HA peer sync test has been completed.
+๐ lab-fw2: Performing backup of configuration to local filesystem.
+๐ lab-fw2: Not a dry run, continue with upgrade.
+๐ lab-fw2: Performing upgrade to version 10.1.3-h3.
+๐ lab-fw2: The install will take several minutes, check for status details within the GUI.
+๐ lab-fw2: Attempting upgrade to version 10.1.3-h3 (Attempt 1 of 3).
+Device 007054000654322 installing version: 10.1.3-h3
+โ
lab-fw2: Upgrade completed successfully
+๐ lab-fw2: Rebooting the target device.
+๐ง lab-fw2: Retry attempt 1 due to error: 007054000654322 not connected
+๐ง lab-fw2: Retry attempt 2 due to error: 007054000654322 not connected
+๐ง lab-fw2: Retry attempt 3 due to error: 007054000654322 not connected
+๐ง lab-fw2: Retry attempt 4 due to error: 007054000654322 not connected
+๐ง lab-fw2: Retry attempt 5 due to error: 007054000654322 not connected
+๐ง lab-fw2: Retry attempt 6 due to error: 007054000654322 not connected
+๐ง lab-fw2: Retry attempt 7 due to error: 007054000654322 not connected
+๐ง lab-fw2: Retry attempt 8 due to error: 007054000654322 not connected
+๐ lab-fw2: Current device version: 10.1.3-h3
+โ
lab-fw2: Device rebooted to the target version successfully.
+๐ lab-fw2: Performing backup of configuration to local filesystem.
+๐ง lab-fw2: Waiting for the device to become ready for the post upgrade snapshot.
+๐ lab-fw2: Performing snapshot of network state information.
+๐ lab-fw2: Attempting to capture network state snapshot (Attempt 1 of 3).
+โ lab-fw2: Error running snapshots: ElementTree.fromstring ParseError: junk after document element: line 1, column 3703
+๐ lab-fw2: Attempting to capture network state snapshot (Attempt 1 of 3).
+โ
lab-fw2: Network snapshot created successfully on attempt 1.
+๐พ lab-fw2: Network state snapshot collected and saved to assurance/snapshots/lab-fw2/post/2024-02-25_04-32-05.json
+๐พ lab-fw2: Snapshot comparison PDF report saved to assurance/snapshots/lab-fw2/diff/2024-02-25_04-32-08_report.pdf
+๐ panorama1.cdot.io: Revisiting firewalls that were active in an HA pair and had the same version as their peers.
+๐ lab-fw1: 007054000654321 192.168.255.41
+๐ lab-fw1: HA mode: active
+๐ lab-fw1: Local state: active, Local version: 10.1.3, Peer version: 10.1.3-h3
+Waiting for HA synchronization to complete on lab-fw1. Attempt 1/3
+HA synchronization complete on lab-fw1. Proceeding with upgrade.
+๐ lab-fw1: Version comparison: older
+๐ lab-fw1: Target device is on an older version
+๐ lab-fw1: Suspending HA state of active
+๐ง lab-fw1: Error received when suspending active target device HA state: argument of type 'NoneType' is not iterable
+๐ lab-fw1: Current version: 10.1.3
+๐ lab-fw1: Target version: 10.1.3-h3
+โ
lab-fw1: Upgrade required from 10.1.3 to 10.1.3-h3
+๐ง lab-fw1: Refreshing list of available software versions
+โ
lab-fw1: version 10.1.3-h3 is available for download
+โ
lab-fw1: Base image for 10.1.3-h3 is already downloaded
+๐ lab-fw1: Performing test to see if 10.1.3-h3 is already downloaded.
+โ
lab-fw1: version 10.1.3-h3 already on target device.
+โ
lab-fw1: 10.1.3-h3 has been downloaded and sync'd to HA peer.
+๐ lab-fw1: Performing snapshot of network state information.
+๐ lab-fw1: Attempting to capture network state snapshot (Attempt 1 of 3).
+โ
lab-fw1: Network snapshot created successfully on attempt 1.
+๐พ lab-fw1: Network state snapshot collected and saved to assurance/snapshots/lab-fw1/pre/2024-02-25_04-33-26.json
+๐ lab-fw1: Performing readiness checks of target firewall.
+๐ lab-fw1: Performing readiness checks to determine if firewall is ready for upgrade.
+โ
lab-fw1: Passed Readiness Check: Check if active support is available
+๐จ lab-fw1: Skipped Readiness Check: Check if a given ARP entry is available in the ARP table
+โ
lab-fw1: Passed Readiness Check: Check if there are pending changes on device
+๐จ lab-fw1: Skipped Readiness Check: Check if the certificates' keys meet minimum size requirements
+๐จ lab-fw1: Skipped Readiness Check: Running Latest Content Version
+โ
lab-fw1: Passed Readiness Check: Check if any Dynamic Update job is scheduled to run within the specified time window
+โ
lab-fw1: Passed Readiness Check: No Expired Licenses
+๐จ lab-fw1: Skipped Readiness Check: Check if a there is enough space on the `/opt/panrepo` volume for downloading an PanOS image.
+๐จ lab-fw1: Skipped Readiness Check: Checks HA pair status from the perspective of the current device
+๐จ lab-fw1: Skipped Readiness Check: Check if a given IPsec tunnel is in active state
+๐จ lab-fw1: Skipped Readiness Check: Check for any job with status different than FIN
+๐จ lab-fw1: Skipped Readiness Check: Check if NTP is synchronized
+โ
lab-fw1: Passed Readiness Check: Check if the clock is synchronized between dataplane and management plane
+โ
lab-fw1: Passed Readiness Check: Check connectivity with the Panorama appliance
+๐จ lab-fw1: Skipped Readiness Check: Check if a critical session is present in the sessions table
+โ
lab-fw1: Readiness Checks completed
+๐ lab-fw1: Checking if HA peer is in sync.
+โ
lab-fw1: HA peer sync test has been completed.
+๐ lab-fw1: Performing backup of configuration to local filesystem.
+๐ lab-fw1: Not a dry run, continue with upgrade.
+๐ lab-fw1: Performing upgrade to version 10.1.3-h3.
+๐ lab-fw1: The install will take several minutes, check for status details within the GUI.
+๐ lab-fw1: Attempting upgrade to version 10.1.3-h3 (Attempt 1 of 3).
+Device 007054000654321 installing version: 10.1.3-h3
+โ
lab-fw1: Upgrade completed successfully
+๐ lab-fw1: Rebooting the target device.
+๐ง lab-fw1: Retry attempt 1 due to error: 007054000654321 not connected
+๐ง lab-fw1: Retry attempt 2 due to error: 007054000654321 not connected
+๐ง lab-fw1: Retry attempt 3 due to error: 007054000654321 not connected
+๐ง lab-fw1: Retry attempt 4 due to error: 007054000654321 not connected
+๐ง lab-fw1: Retry attempt 5 due to error: 007054000654321 not connected
+๐ง lab-fw1: Retry attempt 6 due to error: 007054000654321 not connected
+๐ง lab-fw1: Retry attempt 7 due to error: 007054000654321 not connected
+๐ lab-fw1: Current device version: 10.1.3-h3
+โ
lab-fw1: Device rebooted to the target version successfully.
+๐ lab-fw1: Performing backup of configuration to local filesystem.
+๐ง lab-fw1: Waiting for the device to become ready for the post upgrade snapshot.
+๐ lab-fw1: Performing snapshot of network state information.
+๐ lab-fw1: Attempting to capture network state snapshot (Attempt 1 of 3).
+โ
lab-fw1: Network snapshot created successfully on attempt 1.
+๐พ lab-fw1: Network state snapshot collected and saved to assurance/snapshots/lab-fw1/post/2024-02-25_04-50-28.json
+๐พ lab-fw1: Snapshot comparison PDF report saved to assurance/snapshots/lab-fw1/diff/2024-02-25_04-50-29_report.pdf
+โ
panorama1.cdot.io: Completed revisiting firewalls
+
```
@@ -262,163 +374,7 @@ No inventory.yaml file was found, getting firewalls connected to Panorama.
Create an inventory.yaml file with 'pan-os-upgrade inventory' command.
===========================================================================
โ
panorama.cdot.io: Connection to Panorama established. Firewall connections will be proxied!
-๐ง panorama.cdot.io: Retrieving a list of all firewalls connected to Panorama...
-๐ง panorama.cdot.io: Retrieving detailed information of each firewall...
-โโโโโโโคโโโโโโโโโโโโโโโโคโโโโโโโโโโโโโโโโโโคโโโโโโโโโโคโโโโโโโโโโโโโโโโโโคโโโโโโโโโโโโโโโคโโโโโโโโโโโโโโโโ
-โ # โ Hostname โ IP Address โ Model โ Serial โ SW Version โ App Version โ
-โโโโโโโชโโโโโโโโโโโโโโโโชโโโโโโโโโโโโโโโโโโชโโโโโโโโโโชโโโโโโโโโโโโโโโโโโชโโโโโโโโโโโโโโโชโโโโโโโโโโโโโโโโก
-โ 1 โ Woodlands-fw1 โ 192.168.255.43 โ PA-VM โ 007954000123451 โ 10.1.3 โ 8729-8157 โ
-โโโโโโโผโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโค
-โ 2 โ Woodlands-fw2 โ 192.168.255.44 โ PA-VM โ 007954000123452 โ 10.1.3 โ 8729-8157 โ
-โโโโโโโผโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโค
-โ 3 โ houston โ 192.168.255.211 โ PA-VM โ 007954000123453 โ 10.1.3 โ 8797-8498 โ
-โโโโโโโงโโโโโโโโโโโโโโโโงโโโโโโโโโโโโโโโโโโงโโโโโโโโโโงโโโโโโโโโโโโโโโโโโงโโโโโโโโโโโโโโโงโโโโโโโโโโโโโโโโ
-You can select devices by entering their numbers, ranges, or separated by commas.
-Examples: '1', '2-4', '1,3,5-7'.
-Type 'done' on a new line when finished.
-
-Enter your selection(s): 1,2
-Woodlands-fw1 selected.
-Woodlands-fw2 selected.
-Enter your selection(s): done
-๐ panorama.cdot.io: Upgrading 2 devices to version 10.1.3-h2...
-๐ panorama.cdot.io: Please confirm the selected firewalls:
- - Woodlands-fw1 (192.168.255.43)
- - Woodlands-fw2 (192.168.255.44)
-๐ง panorama.cdot.io: Dry run mode is disabled, upgrade workflow will be executed.
-Do you want to proceed with the upgrade? [y/N]: y
-๐ Proceeding with the upgrade...
-๐ Proceeding with the upgrade...
-๐ง panorama.cdot.io: Using 10 threads.
-๐ Woodlands-fw1: 007954000123451 192.168.255.43
-๐ Woodlands-fw2: 007954000123452 192.168.255.44
-๐ Woodlands-fw1: HA mode: active
-๐ Woodlands-fw2: HA mode: passive
-๐ Woodlands-fw1: Local state: active, Local version: 10.1.3, Peer version: 10.1.3
-๐ Woodlands-fw1: Version comparison: equal
-๐ Woodlands-fw1: Detected active target device in HA pair running the same version as its peer. Added target device to revisit list.
-๐ Woodlands-fw2: Local state: passive, Local version: 10.1.3, Peer version: 10.1.3
-๐ Woodlands-fw2: Version comparison: equal
-๐ Woodlands-fw2: Target device is passive
-๐ Woodlands-fw2: Current version: 10.1.3
-๐ Woodlands-fw2: Target version: 10.1.3-h2
-โ
Woodlands-fw2: Upgrade required from 10.1.3 to 10.1.3-h2
-๐ง Woodlands-fw2: Refreshing list of available software versions
-โ
Woodlands-fw2: version 10.1.3-h2 is available for download
-โ
Woodlands-fw2: Base image for 10.1.3-h2 is already downloaded
-๐ Woodlands-fw2: Performing test to see if 10.1.3-h2 is already downloaded.
-โ
Woodlands-fw2: version 10.1.3-h2 already on target device.
-โ
Woodlands-fw2: 10.1.3-h2 has been downloaded and sync'd to HA peer.
-๐ Woodlands-fw2: Performing snapshot of network state information.
-๐ Woodlands-fw2: Attempting to capture network state snapshot (Attempt 1 of 3).
-โ
Woodlands-fw2: Network snapshot created successfully on attempt 1.
-๐พ Woodlands-fw2: Network state snapshot collected and saved to assurance/snapshots/Woodlands-fw2/pre/2024-02-13_14-18-09.json
-๐ Woodlands-fw2: Performing readiness checks of target firewall.
-๐ Woodlands-fw2: Performing readiness checks to determine if firewall is ready for upgrade.
-โ
Woodlands-fw2: Passed Readiness Check: Check if active support is available
-๐จ Woodlands-fw2: Skipped Readiness Check: Check if a given ARP entry is available in the ARP table
-โ
Woodlands-fw2: Passed Readiness Check: Check if there are pending changes on device
-๐จ Woodlands-fw2: Skipped Readiness Check: Check if the certificates' keys meet minimum size requirements
-๐จ Woodlands-fw2: Skipped Readiness Check: Running Latest Content Version
-โ
Woodlands-fw2: Passed Readiness Check: Check if any Dynamic Update job is scheduled to run within the specified time window
-โ
Woodlands-fw2: Passed Readiness Check: No Expired Licenses
-๐จ Woodlands-fw2: Skipped Readiness Check: Check if a there is enough space on the `/opt/panrepo` volume for downloading an PanOS image.
-โ
Woodlands-fw2: Passed Readiness Check: Checks HA pair status from the perspective of the current device
-๐จ Woodlands-fw2: Skipped Readiness Check: Check if a given IPsec tunnel is in active state
-๐จ Woodlands-fw2: Skipped Readiness Check: Check for any job with status different than FIN
-๐จ Woodlands-fw2: Skipped Readiness Check: Check if NTP is synchronized
-โ
Woodlands-fw2: Passed Readiness Check: Check if the clock is synchronized between dataplane and management plane
-โ
Woodlands-fw2: Passed Readiness Check: Check connectivity with the Panorama appliance
-๐จ Woodlands-fw2: Skipped Readiness Check: Check if a critical session is present in the sessions table
-โ
Woodlands-fw2: Readiness Checks completed
-๐ Woodlands-fw2: Checking if HA peer is in sync.
-โ
Woodlands-fw2: HA peer sync test has been completed.
-๐ Woodlands-fw2: Performing backup of configuration to local filesystem.
-๐ Woodlands-fw2: Not a dry run, continue with upgrade.
-๐ Woodlands-fw2: Performing upgrade to version 10.1.3-h2.
-๐ Woodlands-fw2: The install will take several minutes, check for status details within the GUI.
-๐ Woodlands-fw2: Attempting upgrade to version 10.1.3-h2 (Attempt 1 of 3).
-Device 007954000123452 installing version: 10.1.3-h2
-โ
Woodlands-fw2: Upgrade completed successfully
-๐ Woodlands-fw2: Rebooting the target device.
-๐ Woodlands-fw2: Command succeeded with no output
-๐ง Woodlands-fw2: Retry attempt 1 due to error: 007954000123452 not connected
-๐ง Woodlands-fw2: Retry attempt 2 due to error: 007954000123452 not connected
-๐ง Woodlands-fw2: Retry attempt 3 due to error: 007954000123452 not connected
-๐ง Woodlands-fw2: Retry attempt 4 due to error: 007954000123452 not connected
-๐ง Woodlands-fw2: Retry attempt 5 due to error: 007954000123452 not connected
-๐ง Woodlands-fw2: Retry attempt 6 due to error: 007954000123452 not connected
-๐ง Woodlands-fw2: Retry attempt 7 due to error: 007954000123452 not connected
-๐ง Woodlands-fw2: Retry attempt 8 due to error: 007954000123452 not connected
-๐ง Woodlands-fw2: Retry attempt 9 due to error: 007954000123452 not connected
-๐ Woodlands-fw2: Current device version: 10.1.3-h2
-โ
Woodlands-fw2: Device rebooted to the target version successfully.
-๐ Woodlands-fw2: Performing backup of configuration to local filesystem.
-๐ง Woodlands-fw2: Waiting for the device to become ready for the post upgrade snapshot.
-๐ panorama.cdot.io: Revisiting firewalls that were active in an HA pair and had the same version as their peers.
-๐ Woodlands-fw1: 007954000123451 192.168.255.43
-๐ Woodlands-fw1: HA mode: active
-๐ Woodlands-fw1: Local state: active, Local version: 10.1.3, Peer version: 10.1.3-h2
-Waiting for HA synchronization to complete on Woodlands-fw1. Attempt 1/3
-HA synchronization complete on Woodlands-fw1. Proceeding with upgrade.
-๐ Woodlands-fw1: Version comparison: older
-๐ Woodlands-fw1: Target device is on an older version
-๐ Woodlands-fw1: Suspending HA state of active
-๐ง Woodlands-fw1: Error received when suspending active target device HA state: argument of type 'NoneType' is not iterable
-๐ Woodlands-fw1: Current version: 10.1.3
-๐ Woodlands-fw1: Target version: 10.1.3-h2
-โ
Woodlands-fw1: Upgrade required from 10.1.3 to 10.1.3-h2
-๐ง Woodlands-fw1: Refreshing list of available software versions
-โ
Woodlands-fw1: version 10.1.3-h2 is available for download
-โ
Woodlands-fw1: Base image for 10.1.3-h2 is already downloaded
-๐ Woodlands-fw1: Performing test to see if 10.1.3-h2 is already downloaded.
-โ
Woodlands-fw1: version 10.1.3-h2 already on target device.
-โ
Woodlands-fw1: 10.1.3-h2 has been downloaded and sync'd to HA peer.
-๐ Woodlands-fw1: Performing snapshot of network state information.
-๐ Woodlands-fw1: Attempting to capture network state snapshot (Attempt 1 of 3).
-โ
Woodlands-fw1: Network snapshot created successfully on attempt 1.
-๐พ Woodlands-fw1: Network state snapshot collected and saved to assurance/snapshots/Woodlands-fw1/pre/2024-02-13_14-37-49.json
-๐ Woodlands-fw1: Performing readiness checks of target firewall.
-๐ Woodlands-fw1: Performing readiness checks to determine if firewall is ready for upgrade.
-โ
Woodlands-fw1: Passed Readiness Check: Check if active support is available
-๐จ Woodlands-fw1: Skipped Readiness Check: Check if a given ARP entry is available in the ARP table
-โ
Woodlands-fw1: Passed Readiness Check: Check if there are pending changes on device
-๐จ Woodlands-fw1: Skipped Readiness Check: Check if the certificates' keys meet minimum size requirements
-๐จ Woodlands-fw1: Skipped Readiness Check: Running Latest Content Version
-โ
Woodlands-fw1: Passed Readiness Check: Check if any Dynamic Update job is scheduled to run within the specified time window
-โ
Woodlands-fw1: Passed Readiness Check: No Expired Licenses
-๐จ Woodlands-fw1: Skipped Readiness Check: Check if a there is enough space on the `/opt/panrepo` volume for downloading an PanOS image.
-๐จ Woodlands-fw1: Skipped Readiness Check: Checks HA pair status from the perspective of the current device
-๐จ Woodlands-fw1: Skipped Readiness Check: Check if a given IPsec tunnel is in active state
-๐จ Woodlands-fw1: Skipped Readiness Check: Check for any job with status different than FIN
-๐จ Woodlands-fw1: Skipped Readiness Check: Check if NTP is synchronized
-โ
Woodlands-fw1: Passed Readiness Check: Check if the clock is synchronized between dataplane and management plane
-โ
Woodlands-fw1: Passed Readiness Check: Check connectivity with the Panorama appliance
-๐จ Woodlands-fw1: Skipped Readiness Check: Check if a critical session is present in the sessions table
-โ
Woodlands-fw1: Readiness Checks completed
-๐ Woodlands-fw1: Checking if HA peer is in sync.
-โ
Woodlands-fw1: HA peer sync test has been completed.
-๐ Woodlands-fw1: Performing backup of configuration to local filesystem.
-๐ Woodlands-fw1: Not a dry run, continue with upgrade.
-๐ Woodlands-fw1: Performing upgrade to version 10.1.3-h2.
-๐ Woodlands-fw1: The install will take several minutes, check for status details within the GUI.
-๐ Woodlands-fw1: Attempting upgrade to version 10.1.3-h2 (Attempt 1 of 3).
-Device 007954000123451 installing version: 10.1.3-h2
-โ
Woodlands-fw1: Upgrade completed successfully
-๐ Woodlands-fw1: Rebooting the target device.
-๐ Woodlands-fw1: Command succeeded with no output
-๐ง Woodlands-fw1: Retry attempt 1 due to error: 007954000123451 not connected
-๐ง Woodlands-fw1: Retry attempt 2 due to error: 007954000123451 not connected
-๐ง Woodlands-fw1: Retry attempt 3 due to error: 007954000123451 not connected
-๐ง Woodlands-fw1: Retry attempt 4 due to error: 007954000123451 not connected
-๐ง Woodlands-fw1: Retry attempt 5 due to error: 007954000123451 not connected
-๐ง Woodlands-fw1: Retry attempt 6 due to error: 007954000123451 not connected
-๐ง Woodlands-fw1: Retry attempt 7 due to error: 007954000123451 not connected
-๐ง Woodlands-fw1: Retry attempt 8 due to error: 007954000123451 not connected
-๐ง Woodlands-fw1: Retry attempt 9 due to error: 007954000123451 not connected
-๐ Woodlands-fw1: Current device version: 10.1.3-h2
-โ
Woodlands-fw1: Device rebooted to the target version successfully.
-๐ Woodlands-fw1: Performing backup of configuration to local filesystem.
+... shortened for brevity ...
๐ง Woodlands-fw1: Waiting for the device to become ready for the post upgrade snapshot.
โ
panorama.cdot.io: Completed revisiting firewalls
```
@@ -452,44 +408,52 @@ pan-os-upgrade inventory
Panorama hostname or IP: panorama1.cdot.io
Panorama username: officehours
Panorama password:
-=================================================================================
+=================================================================================================
Welcome to the PAN-OS upgrade inventory menu
-Select which firewalls to upgrade based on a list of those connected to Panorama.
+This script software is provided on an 'as-is' basis with no warranties, and no support provided.
-This will create an `inventory.yaml` file in your current working directory.
-=================================================================================
+The selected 'inventory' subcommand will create `inventory.yaml` in your current directory.
+This `inventory.yaml` file will contain firewalls to upgrade and will be loaded at runtime.
+=================================================================================================
+๐ panorama1.cdot.io: Connection to the appliance successful.
โ
panorama1.cdot.io: Connection to Panorama established.
๐ง panorama1.cdot.io: Retrieving a list of all firewalls connected to Panorama...
๐ง panorama1.cdot.io: Retrieving detailed information of each firewall...
-โโโโโโโคโโโโโโโโโโโโโคโโโโโโโโโโโโโโโโโคโโโโโโโโโโคโโโโโโโโโโโโโโโโโโคโโโโโโโโโโโโโโโคโโโโโโโโโโโโโโโโ
-โ # โ Hostname โ IP Address โ Model โ Serial โ SW Version โ App Version โ
-โโโโโโโชโโโโโโโโโโโโโชโโโโโโโโโโโโโโโโโชโโโโโโโโโโชโโโโโโโโโโโโโโโโโโชโโโโโโโโโโโโโโโชโโโโโโโโโโโโโโโโก
-โ 1 โ katy-fw1 โ 192.168.255.41 โ PA-VM โ 007954000123454 โ 10.1.3-h2 โ 8799-8509 โ
-โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโค
-โ 2 โ katy-fw2 โ 192.168.255.42 โ PA-VM โ 007954000123455 โ 10.1.3-h2 โ 8799-8509 โ
-โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโค
-โ 3 โ lab-fw1 โ 192.168.255.11 โ PA-VM โ 007954000123456 โ 10.1.3-h3 โ 8729-8157 โ
-โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโค
-โ 4 โ lab-fw2 โ 192.168.255.12 โ PA-VM โ 007954000123457 โ 10.1.3-h3 โ 8729-8157 โ
-โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโค
-โ 5 โ lab-fw3 โ 192.168.255.13 โ PA-VM โ 007954000123458 โ 10.1.3-h3 โ 8729-8157 โ
-โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโค
-โ 6 โ lab-fw4 โ 192.168.255.14 โ PA-VM โ 007954000123459 โ 10.1.3-h3 โ 8729-8157 โ
-โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโค
-โ 7 โ lab-fw5 โ 192.168.255.15 โ PA-VM โ 007954000123460 โ 10.1.3-h3 โ 8729-8157 โ
-โโโโโโโงโโโโโโโโโโโโโงโโโโโโโโโโโโโโโโโงโโโโโโโโโโงโโโโโโโโโโโโโโโโโโงโโโโโโโโโโโโโโโงโโโโโโโโโโโโโโโโ
+โโโโโโโคโโโโโโโโโโโโโคโโโโโโโโโโโโโโโโโคโโโโโโโโโโคโโโโโโโโโโโโคโโโโโโโโโโโโคโโโโโโโโโโโโคโโโโโโโโโโโโ
+โ # โ Hostname โ IP Address โ Model โ PAN-OS โ Content โ HA Mode โ Preempt โ
+โโโโโโโชโโโโโโโโโโโโโชโโโโโโโโโโโโโโโโโชโโโโโโโโโโชโโโโโโโโโโโโชโโโโโโโโโโโโชโโโโโโโโโโโโชโโโโโโโโโโโโก
+โ 1 โ katy-fw1 โ 192.168.255.41 โ PA-VM โ 10.1.3-h3 โ 8799-8509 โ passive โ no โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 2 โ katy-fw2 โ 192.168.255.42 โ PA-VM โ 10.1.3-h3 โ 8799-8509 โ active โ no โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 3 โ lab-fw1 โ 192.168.255.11 โ PA-VM โ 10.1.4 โ 8729-8157 โ disabled โ N/A โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 4 โ lab-fw2 โ 192.168.255.12 โ PA-VM โ 10.1.3-h3 โ 8729-8157 โ disabled โ N/A โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 5 โ lab-fw3 โ 192.168.255.13 โ PA-VM โ 10.1.3 โ 8729-8157 โ disabled โ N/A โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 6 โ lab-fw4 โ 192.168.255.14 โ PA-VM โ 10.1.3 โ 8729-8157 โ disabled โ N/A โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 7 โ lab-fw5 โ 192.168.255.15 โ PA-VM โ 10.1.3-h3 โ 8729-8157 โ disabled โ N/A โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 8 โ lab-fw6 โ 192.168.255.16 โ PA-VM โ 10.1.4-h4 โ 8729-8157 โ active โ yes โ
+โโโโโโโผโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโผโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโผโโโโโโโโโโโโค
+โ 9 โ lab-fw7 โ 192.168.255.17 โ PA-VM โ 10.1.4-h4 โ 8729-8157 โ passive โ yes โ
+โโโโโโโงโโโโโโโโโโโโโงโโโโโโโโโโโโโโโโโงโโโโโโโโโโงโโโโโโโโโโโโงโโโโโโโโโโโโงโโโโโโโโโโโโงโโโโโโโโโโโโ
You can select devices by entering their numbers, ranges, or separated by commas.
Examples: '1', '2-4', '1,3,5-7'.
Type 'done' on a new line when finished.
-Enter your selection(s): 1, 3-5, 7
-katy-fw1 selected.
-lab-fw1 selected.
-lab-fw2 selected.
-lab-fw3 selected.
-lab-fw5 selected.
+Enter your selection(s): 3,6,8-9
+ - lab-fw1 selected.
+ - lab-fw4 selected.
+ - lab-fw6 selected.
+ - lab-fw7 selected.
Enter your selection(s): done
+Warning: Firewalls lab-fw6, lab-fw7 have 'preempt' enabled, this can cause an interruption.
+Are you sure that you want to add these firewalls to the upgrade list? (y/n): n
+Firewalls with 'preempt' set to 'yes' have been excluded.
Selected devices saved to inventory.yaml
```
@@ -499,11 +463,8 @@ This `inventory.yaml` file can then be used in subsequent upgrade commands to pr
```yaml
firewalls_to_upgrade:
-- katy-fw1
- lab-fw1
-- lab-fw2
-- lab-fw3
-- lab-fw5
+- lab-fw4
```
When the subcommand of `batch` is executed, it will look in the current working directory for a file named `inventory.yaml`, and if its found it will use the file's contents as a source of inventory, bypassing the firewall selection menu.
@@ -682,18 +643,28 @@ You will be able to confirm that the file was discovered by the message within t
```console
-pan-os-upgrade firewall -v 10.2.5 -u cdot -h houston.cdot.io
+pan-os-upgrade firewall
+Firewall hostname or IP: lab-fw1.cdot.io
+Firewall username: officehours
Firewall password:
-Dry Run? [Y/n]:
-=========================================================
+Target version: 10.1.4
+Dry Run? [Y/n]: n
+=================================================================================================
Welcome to the PAN-OS upgrade tool
-You have selected to upgrade a single Firewall appliance.
+This script software is provided on an 'as-is' basis with no warranties, and no support provided.
+
+The selected `firewall` subcommand will upgrade a single Firewall appliance.
-Custom configuration loaded from:
-/Users/cdot/development/pan-os-upgrade/settings.yaml
-=========================================================
-๐ houston: 007954000123453 192.168.255.211
+Settings: Custom configuration loaded file detected and loaded at:
+/app/settings.yaml
+=================================================================================================
+๐ lab-fw1.cdot.io: Connection to the appliance successful.
+๐ lab-fw1: 007054000654320 192.168.255.11
+๐ lab-fw1: HA mode: disabled
+๐ lab-fw1: Current version: 10.1.3-h3
+๐ lab-fw1: Target version: 10.1.4
+โ
lab-fw1: Upgrade required from 10.1.3-h3 to 10.1.4
... shortened for brevity ...
```