An administrator plans to upgrade a pair of active/passive firewalls to a new PAN-OS release. The environment is highly sensitive, and downtime must…

The recommended procedure for upgrading an active/passive High Availability (HA) pair with minimal service disruption is a sequential process that leverages the HA failover mechanism. The process begins by suspending the currently active firewall, which triggers a graceful, controlled failover to the passive peer. Once the passive peer takes over the active role and is handling traffic, the now-passive (originally active) firewall can be safely upgraded and rebooted. After verifying its operation, a second controlled failover is performed to make the newly upgraded firewall active. Finally, the remaining firewall is upgraded. This method ensures that one firewall is always online and processing traffic, limiting downtime to the brief transition period during each failover.

B: Shutting down the active firewall is a hard stop, not a graceful failover, and is more disruptive than suspending the device for a controlled transition.

C: Isolating and upgrading both firewalls offline causes a complete service outage, which is the opposite of minimizing disruption in a highly sensitive environment.

D: Upgrading and rebooting both firewalls simultaneously guarantees a total network outage, as both devices would be unavailable at the same time, defeating the purpose of HA.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0: In the section "Upgrade the Firewalls in an HA Pair

" the official documentation outlines the precise procedure. Step 3 explicitly states

"Suspend the active firewall to trigger a failover to the passive firewall." The subsequent steps detail upgrading the now-passive device

followed by failing over again to upgrade the second device. This directly supports the methodology described in option A.

Reference: Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide 11.0. Section: Device > High Availability > Upgrade the Firewalls in an HA Pair.

2. Palo Alto Networks Knowledge Base

Document ID 211309: This best-practice article

"How to Upgrade an HA Pair

" details the step-by-step process. It advises

"On the currently active firewall

suspend the local device to cause a failover... After the failover is complete

the previously active firewall is now the passive firewall. Reboot the passive firewall to complete the upgrade." This confirms that suspending the active unit to initiate a failover is the correct first operational step for a minimal-downtime upgrade.