software update question

Dustynet — Thu, 22 Aug 2024 15:41:57 GMT

When updating Palo firewalls, why the need to update through each base version as well as a preferred maintenance version?

e.g. if going from version 8.1.x, to 10.1.x, why 9.0 > 9.0.x > 9.1 > 9.1 > 10.0 etc.

IF each baseline version release e.g. 9.0, 9.1, 10.0 is a full release of the software then what is to stop upgrading to 9.0 > 10.0 > 10.1 skipping the interim preferred maintenance releases?

The only obvious 2x explanations that I can come up with are :

the baseline releases for 9.0, 10.0 etc are not in fact full versions of the firewall software and must have a dependency on previous versions.
The preferred maintenance versions are ONLY required if upgrading a firewall with an existing configuration, so that each version update can rewrite each policy rule in line with internal database changes etc. thus not corrupting the configuration if theoretically jumping from 8.1.x to 10.1.0 for example.

Does anyone have any internal level of technical understanding which can confirm if I can get away with upgrading from 8.1.x to 10.1.0 without interim versions, on an otherwise factory reset firewall with no customised configuration in place?

Always curious!

Re: software update question

reaper — Mon, 26 Aug 2024 23:29:31 GMT

it is perfectly possible to perform these upgrades using only the base versions

that said, it is recommended to also download the latest maintenance release to protect you from running into any bugs while you're upgrading

so you can do

8.1.x > 9.0.0 > 9.1.0 > 10.0.0 > 10.1.0 (starting from 10.1 you can actually skip intermediate versions so you could do 10.1 > 11.1)

but if you run into a bug, you may need to get TAC involved and your upgrade grinds to a halt

hence the recommendation to

from 8.1.x

download 9.0.0 and 9.0.17-h5, install and reboot 9.0.17-h5

download 9.1.0 and 9.1.18, install and reboot 9.1.18

download 10.0.0 and 10.0.12, install and reboot 10.0.12

download 10.1.0 and 10.1.13-h1, install and reboot 10.1.13-h1

if you're feeling lucky and there's no config on the firewall, feel free to go for the base images only

hope this helps

topic software update question in Next-Generation Firewall Discussions

software update question

Re: software update question