Upgrade path from 10.2.3-h14 to 11.1.4-h7

watkfr — Tue, 11 Feb 2025 19:04:17 GMT

I have a 5410 with current version 10.2.3-14 that is HA and would like to upgrade to 11.1.4-h7. What is the path and how many reboots?

Re: Upgrade path from 10.2.3-h14 to 11.1.4-h7

reaper — Wed, 12 Feb 2025 10:52:18 GMT

download 11.1.0,
download 11.1.4-h7,
install 11.1.4-h7,
reboot

so 1 reboot 🙂

(starting from 10.1 you can skip up to 3 major versions, so you don't need to install 11.0)

Re: Upgrade path from 10.2.3-h14 to 11.1.4-h7

CosminM — Wed, 12 Feb 2025 11:55:20 GMT

Hello @watkfr

As @reaper mnetioned you can skip up to 3 version when you upgrade a individual firewall.

"When upgrading HA firewalls across multiple feature PAN-OS releases, you must upgrade each HA peer to the same feature PAN-OS release on your upgrade path before continuing. For example, you are upgrading HA peers from PAN-OS 10.2 to PAN-OS 11.1. You must upgrade both HA peers to PAN-OS 11.0 before you can continue upgrading to the target PAN-OS 11.1 release. When HA peers are two or more feature releases apart, the firewall with the older release installed enters a suspended state with the message Peer version too old. "

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/upgrade-an-ha-firewall-pair

So, according with the above statement from TECH DOCS, you will need first to upgrade both HA peers to 11.0.x and after that to 11.1.x.

If the firewall with older release enters to suspend state before the other peer to be fully functional, then you will have service interruption.

Even PAN-OS 11.0 it's end of support, you still need to use it as transitional state.

1. download 11.0.0

2. download 11.0.4-h6 (the latest preferred release from 11.0) + install

3. reboot the first firewall

4. repeat steps 1-2 for second firewall and reboot second firewall

4. download 11.1.0

5. download 11.1.4-h7 (the latest preferred release from 11.1) + install

6. second reboot for first firewall

7. repeat steps 5-6 for second firewall

8. second reboot for the second firewall

Each HA peer will have 2 reboots.

topic Re: Upgrade path from 10.2.3-h14 to 11.1.4-h7 in Next-Generation Firewall Discussions

Upgrade path from 10.2.3-h14 to 11.1.4-h7

Re: Upgrade path from 10.2.3-h14 to 11.1.4-h7

Re: Upgrade path from 10.2.3-h14 to 11.1.4-h7