topic Re: Downgrading from PANOS-9.1.0-h3 to 9.0.4 -- access fails, logon in VM-Series in the Public Cloud

Downgrading from PANOS-9.1.0-h3 to 9.0.4 -- access fails, logon

doug-elliott — Tue, 24 Mar 2020 23:45:04 GMT

After Downgrading from PANOS-9.1.0-h3 to PANOS 9.0, in Azure, VM100 fails to accept logon. I've tried twice. Once to base 9.0 and another to 9.0.4 with base downloaded. Is this downgrade path not supported?

Re: Downgrading from PANOS-9.1.0-h3 to 9.0.4 -- access fails, logon

JoergSchuetter — Thu, 26 Mar 2020 14:43:08 GMT

Hello @doug-elliott

We did a downgrade from 9.1.x (don't know the exact details) to 9.0.6 (in Azure). Not sure if this can be compared to your situation, since the 9.1 was not configured at all (besides the mgn interface and the local admin user). Keep in mind that the default user (admin) might not be configured. In the deployment task we provided a different user name.

Re: Downgrading from PANOS-9.1.0-h3 to 9.0.4 -- access fails, logon

dleitzel — Thu, 26 Mar 2020 20:44:12 GMT

I ran into the same issue when I tried 9.1 down to 9.0.4. What did work was 9.1 down to 9.0.6 then down to 9.0.4. Not sure exactly why a straight shot down to 9.0.4 isn't working, but adding an intermediate step to 9.0.6 does.

Re: Downgrading from PANOS-9.1.0-h3 to 9.0.4 -- access fails, logon

jmeurer — Thu, 26 Mar 2020 20:52:36 GMT

BTW...9.0.4 is available in Azure for direct install. It might be cleaner to install 9.0.4 directly and restore your config.

Re: Downgrading from PANOS-9.1.0-h3 to 9.0.4 -- access fails, logon

doug-elliott — Fri, 27 Mar 2020 01:46:19 GMT

Thanks for the solution, I found this to be the way to go. As a follow up to the other replies, I made another attempt to downgrade to 9.0.4 with another firewall (the HA partner) by downloading the base and attempting to install 9.0.4. Same result. 9.1.0-h3 was installed as part of a solution template I used from Github. For the replacement firewall, decided to deploy a single firewall at PANOS 9.0.4 and avoid the downgrade. Much better idea so be careful with solution templates and what they deploy.

Thanks for your responses.