An administrator plans to upgrade a pair of active/passive firewalls to a new PAN-OS release. The environment is highly sensitive, and downtime must be minimized. What is the recommended upgrade process for minimal disruption in this high availability (HA) scenario?

The official Palo Alto Networks best practice for upgrading an Active/Passive High Availability (HA) pair with minimal downtime is a sequential upgrade process. First, the administrator must gracefully suspend the currently active firewall, which triggers a seamless failover of traffic to the passive peer. The newly suspended (now passive) firewall is then upgraded to the new PAN-OS release and rebooted. Once this firewall is back online and fully operational, the administrator suspends the currently active firewall (running the older PAN-OS). This action fails traffic over to the newly upgraded firewall, allowing the administrator to verify that the new PAN-OS version handles production traffic correctly. Finally, the remaining passive firewall is upgraded and rebooted, completing the process without dropping active sessions.

Option B: Shutting down the firewall is not the recommended graceful failover method; suspending the device is the official best practice to maintain HA state and prevent split-brain scenarios.
Option C: Isolating both firewalls simultaneously removes them from the production network, causing a complete network outage, which directly violates the requirement to minimize downtime.
Option D: Upgrading and rebooting both firewalls simultaneously will result in a complete network outage during the reboot cycle, causing unacceptable downtime in a highly sensitive environment.

1. Palo Alto Networks. (2023). PAN-OS 11.0 Administrator's Guide. Section: "Software Updates" -> "Upgrade Firewalls in an HA Pair". This section explicitly details the procedure of suspending the active peer to trigger a failover before upgrading the passive device to ensure zero-to-minimal downtime.

2. Palo Alto Networks. (2022). PAN-OS 10.2 Administrator's Guide. Section: "High Availability" -> "HA Operational Commands". Details the use of the "Suspend local device" command for graceful HA failover during maintenance windows.