Use case
An HA pair, upgraded at 1 a.m., without you watching a terminal
A security advisory lands on Tuesday. The firewalls in front of the data centre have to move to a fixed release, the change board gives you Saturday 01:00–03:00, and nobody wants to sit up all night refreshing a CLI session. Here is how that night goes with Night Agent.
The situation
Why this upgrade is the one people dread
An active/passive pair is not a single firewall run twice. The order matters, preemption can pull traffic back at the wrong moment, and PAN-OS tends to drop your API session halfway through a half-hour install. Doing it by hand means a runbook, two SSH windows and a lot of staring.
The pair
Two VM-Series or hardware firewalls in active/passive HA, for
example 192.0.2.10 and 192.0.2.11, carrying
production traffic.
The window
Two hours, in the middle of the night, approved by a change board that will want evidence afterwards.
The engineer
One person, who would like to sleep and still be the first to know if something goes wrong.
Friday afternoon
Find the problems while it's still daylight
Pre-flight checks run on their own, without upgrading anything, on both units side by side. Anything that would stop the upgrade at 01:00 shows up now, when fixing it is easy.
What gets checked
- HA state and sync on both units
- Free disk space, in GB, against the actual image you chose
- The upgrade path, validated before anything is downloaded
- NTP, pending commits, config locks, running jobs, CPU and licences
- Known vulnerabilities in the version you're leaving
Then schedule it
Pick Saturday 01:00 in your own time zone — daylight saving is handled per region, not by the server clock. You can keep the credentials with the job, encrypted at rest, so it can run without you at the keyboard.
Turn on email for when the run starts, finishes, or needs you. Use Night Agent's built-in email service with nothing to set up, or your own SMTP server.
Saturday, 01:00
What happens while you sleep
Times are illustrative; a real install takes as long as PAN-OS takes. The order is not illustrative — it's the order Night Agent enforces.
01:00 · The run starts, and so does your inbox
The scheduler fires on time in your own time zone. An “upgrade started” email names the pair and the target version, so you know it began without opening anything.
01:02 · Backup and a picture of “before”
The running configuration is exported, then a snapshot records interfaces, routes, BGP peers, ARP, sessions, IPsec tunnels and licences. That is what the morning comparison is measured against.
01:10 · Preemption off, image staged once
If preemption is on, it is switched off and committed, so a rebooting unit cannot snatch traffic back on its own. The image is downloaded once and synced to the peer.
01:20 · First unit: suspend, install, reboot
The first unit is suspended, so its peer carries the traffic. It installs and reboots. When PAN-OS closes the API session mid-install — it usually does — Night Agent reconnects and follows the newest install job instead of losing the thread.
01:55 · Nothing moves until it has rejoined
The upgraded unit has to come back passive and state-synced before the second unit is touched. An optional wait between units gives you a soak period if you want one.
02:05 · Second unit, same discipline
Traffic moves to the upgraded unit, the second one installs and reboots, and it too must rejoin and sync. Both versions are verified, and preemption is restored only if it was on to begin with.
02:50 · Finished — and you find out from your phone
A “finished” email gives the outcome, the version, the duration and the run ID. If you are asleep, it is waiting for you. If something failed, you know before the first help-desk ticket does.
If it isn't routine
It stops and asks rather than guessing
A decision only you should make
When a step can't safely be decided on your behalf, the run pauses and emails you. Answer from the status page, or let it wait: after an hour it fails cleanly instead of hanging, with the pair in a known state.
What the emails contain — and don't
The device addresses, the versions, the outcome, the times and the run ID. Never credentials, configuration or logs. With the built-in service, that short summary goes to our email service to be sent; if you'd rather nothing at all left your network, use your own SMTP server.
Saturday morning
Coffee, then close the change
The post-upgrade snapshot is compared with the one taken at 01:02. You get a report you can attach to the change ticket instead of a screenshot of a terminal.
The evidence
- Before-and-after comparison: routes, BGP peers, ARP, sessions, IPsec tunnels, interfaces
- The configuration backup taken before anything changed
- Both snapshots, the pre-check results and the full log, kept in run history
Being straight about it
An HA upgrade still means failovers, and a failover can briefly interrupt traffic. Night Agent makes the sequence disciplined and visible; it doesn't make physics go away. Try it on a lab or non-critical pair first — that's what the trial is for.
See Night Agent on your own firewalls
Confirm your email with a 6-digit code and your license key and download link appear straight away. No sales call, no card.
Early Access Beta · 30-day trial · No card required