topic Re: Upgrade path from PANOS 9.0.17-h5 to 10.1.13-h1 in Next-Generation Firewall Discussions

Upgrade path from PANOS 9.0.17-h5 to 10.1.13-h1

deepakkumar29 — Fri, 19 Jul 2024 12:18:08 GMT

Hi Experts,

I'm going to upgrade from PANOS 9.0.17-h5 to 10.1.13-h1. Could you please advise me the download and install path. Additionally, Tell me how many reboots. It would require reaching out to 10.1.13-h1.

Moreover, can you please help in order to prepare a plan, we need to determine how much time to request for the change window and the expected duration for a reboot cycle.

Re: Upgrade path from PANOS 9.0.17-h5 to 10.1.13-h1

zahmed01 — Fri, 19 Jul 2024 16:04:42 GMT

Hello @deepakkumar29 ,

The upgrade path would be as follows:

Download and install the latest preferred PAN-OS 9.1 maintenance release and reboot.
Download PAN-OS 10.0.0.
Download and install the latest preferred PAN-OS 10.0 maintenance release and reboot.
Proceed to Upgrade the Firewall to PAN-OS 10.1.

However I would recommend you take a look at the End of Life for PANOS versions to see when 10.1 will go EOL and compare with 10.2 or even 11.1. This will give you an idea of the updated PANOS versions available to help reduce how many times you will need to go through an entire upgrade path in the next 1-2 years or so.

It can be difficult to determine how long a change window should last so I would recommend perhaps testing the upgrade in a lab environment to get a potential idea of how long the process can take.

Thanks,

Re: Upgrade path from PANOS 9.0.17-h5 to 10.1.13-h1

deepakkumar29 — Mon, 22 Jul 2024 18:43:17 GMT

Thank you. So, it would require 3 reboots to reach 10.1.13-h1. right ?

Re: Upgrade path from PANOS 9.0.17-h5 to 10.1.13-h1

deepakkumar29 — Mon, 22 Jul 2024 22:20:03 GMT

Hi,

Could you please share the roll back steps and how many reboot require during this roll back steps

Re: Upgrade path from PANOS 9.0.17-h5 to 10.1.13-h1

RomainSalmon — Tue, 23 Jul 2024 08:39:59 GMT

Hello,

I have upgraded from 9.1 to 10.2 and it have taken 5hours (including debug for a new functionality). 3 reboots were needed.

I really advise you to check new features via release notes to be sure that you will have no impact. I strongly suggest that you opened a tac before your operation in order that if you have a problem the tac will be available straight.

Back up configuration and device state before every upgrade.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-pan-os/downgrade-pan-os/downgrade-a-firewall-to-a-previous-feature-release

For the rolll back u may have to do 3 reboots in order to be safe : 10.1.x--->10.0.x--->9.1.x

FYI : "While upgrading to PAN-OS 10.1, the firewall may perform a file system integrity check (FSCK), displaying the following message: RAID log disks check in progress, please wait.
The FSCK is required for the upgrade and may take an hour or more. Do not reboot or attempt to install another software release while the FSCK is in progress".

Re: Upgrade path from PANOS 9.0.17-h5 to 10.1.13-h1

deepakkumar29 — Tue, 23 Jul 2024 14:31:28 GMT

Thank you. Just one more query, do i need to perform dynamic upgrade after each version update and reboot ?

Re: Upgrade path from PANOS 9.0.17-h5 to 10.1.13-h1

RomainSalmon — Tue, 23 Jul 2024 14:38:46 GMT

Are you talking about the dynamic updates ? If yes, it's a best practice to do it before the upgrade and to check that your passive firewall gets the same version.