Upgrade path 10.2.9-h1 to 1.1.4-h7

yeruel — Fri, 06 Dec 2024 13:04:49 GMT

Hello Palo experts,

I am planning to upgrade the existing PAN 5220 HA firewall with a Panorama virtual appliance. The current PAN-OS version is 10.2.9-h1.

Could you assist with the correct and valid upgrade path from PAN-OS 10.2.9-h1 to 11.1.4-h7?

Can we do the below?

1. download 11.1.0 ( not install)

2. download 11.1.4-h7 and install on Palo PA 5220 HA firewall and Panorama

is that possible?

Re: Upgrade path 10.2.9-h1 to 1.1.4-h7

jpomachagua — Fri, 06 Dec 2024 21:05:29 GMT

Based on the information in this document (https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path), you can proceed with a direct upgrade to version 11.1.4. As you mentioned, it will only be necessary to download the 11.1.0 version.

Here are some recommendations:

It is best practice to upgrade Panorama first, followed by the firewalls.
Once Panorama is upgraded, suspend the firewall that you plan to work with and proceed with the upgrade.
After the first firewall has been upgraded, force the high availability (HA) and proceed with the upgrade of the other firewall.

Regards