stable version for 11

[shirishkulkarni]

Hello Team,

Currently we have virtual firewall vm100 with version 10.2.4-h3, I want to update it to 11 version.

Could you please let us know the stable version for pan 11.

[Claw4609]

Hello, 

Current preferred release of 11.0 is 11.0.3-h3 and for 11.1 is 11.1.2 for the following platforms: PA-4XX, PA-14XX, PA-34XX, PA-54XX

PAN-OS release guidance article: Support PAN-OS Software Release Guidance | Palo Alto Networks

Is there something you are looking to gain by updating to 11.x at the moment? PAN-OS 11.x is still relatively new so curious what you're looking to achieve as I would recommend against updating just for the sake of updating.

[shirishkulkarni]

Our intention is to make the firewall free from the current high vul. Could you please suggest which is the best version of the virtual firewall to upgrade?

firewall: vm100 with version 10.2.4-h3

[Claw4609]

This vuln?: CVE-2023-38802 PAN-OS: Denial-of-Service (DoS) Vulnerability in BGP Software (paloaltonetworks.com)

Why not just go to 10.2.6-h1 or higher instead of a major software release? 

The VM series has the same preferred release as the physical PA series firewalls, unless otherwise specified. So currently its 10.2.8 and 11.0.3-h3. With 11.x still being relatively new and 10.2 still being fully supported until August of 2025 I would recommend staying on the same major release and go with one of the following: 10.2.6-h1, 10.2.7-h6, or 10.2.8. Would recommend looking at the two attached articles down below to take note of any bugs that would apply to you when choosing the specific version. We have our VM series running on 10.2.6-h1 with no issues, we updated some of our physical firewalls to 10.2.8 an experienced some issues but we never updated one of the vm series to 10.2.8 so I can't speak on that.

Known issues for 10.2.x: PAN-OS 10.2.8 Known Issues (paloaltonetworks.com)

Heres the list of preferred versions: Support PAN-OS Software Release Guidance | Palo Alto Networks