topic Re: Upgrade from 10.1.12 to 11.1.13 in Panorama Discussions

Upgrade from 10.1.12 to 11.1.13

Sathaporn — Tue, 24 Mar 2026 04:25:06 GMT

Currently, I have one Panorama M-200 running OS version 10.1.12, and two PA-3220 devices running OS version 10.1.12 configured in HA Active-Passive mode. The PA-3220 devices are fully managed by Panorama, including configuration and log storage.

Now, I would like to upgrade the OS to version 11.1.13. I came across the “Skip Software Version” upgrade procedure in the Palo Alto KB, and I would like to confirm whether I can follow the steps below:

Panorama

Download 11.1.0 (Base Image)
Download 11.1.13 (Preferred Release)
Install 11.1.13 and reboot

PA-3220
Disable Preemption

PA-02 (Passive)

Download 11.1.0 (Base Image)
Download 11.1.13 (Preferred Release)
Install 11.1.13 and reboot

PA-01 (Active)

Suspend PA-01 to make PA-02 active
Download 11.1.0 (Base Image)
Download 11.1.13 (Preferred Release)
Install 11.1.13 and reboot

Is this procedure correct for a Skip Software Version upgrade?
Also, is there any function or feature that needs to be enabled beforehand to perform a Skip Software Version upgrade?

Thank you.

Re: Upgrade from 10.1.12 to 11.1.13

TomYoung — Tue, 24 Mar 2026 17:52:58 GMT

Hi @Sathaporn ,

You can upgrade directly from PAN-OS 10.1 to 11.1. Please refer to the table here -> https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path.

Your procedure is correct.

There is no function or feature that needs to be enabled beforehand to my knowledge. It is always a good idea to review the Upgrade/Downgrade Considerations link which is directly above the table.

Thanks,

Tom

Re: Upgrade from 10.1.12 to 11.1.13

Sathaporn — Wed, 25 Mar 2026 07:44:25 GMT

Hi @TomYoung

Thank you for the recommendation. I have another question: in the case of rolling back from version 11.1.13 to 10.1.12, can I simply install OS version 10.1.12, load the configuration file from version 10.1.12, and reboot to apply the previous OS version?

Thank you,

Re: Upgrade from 10.1.12 to 11.1.13

nohash4u — Wed, 25 Mar 2026 14:43:04 GMT

Hi @Sathaporn,

I would advise that when reverting from 11.1.13 to 10.1.12 you complete the downgrade process first (install and reboot), and then load the configuration file from version 10.1.12.

Re: Upgrade from 10.1.12 to 11.1.13

TomYoung — Wed, 25 Mar 2026 17:32:13 GMT

Hi @Sathaporn ,

You must downgrade to 11.0, 10.2, and then 10.1. As @nohash4u said, it is best to save your 10.1 configuration before upgrading, and keep it in case you need to downgrade.

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-panorama/install-content-and-software-updates-for-panorama/downgrade-from-panorama

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-upgrade/upgrade-panorama/install-content-and-software-updates-for-panorama/downgrade-from-panorama

If my original reply answered your question, please mark it as the solution!

Thanks,

Tom

Re: Upgrade from 10.1.12 to 11.1.13

Sathaporn — Thu, 26 Mar 2026 01:50:53 GMT

Hi @TomYoung

I’m a bit confused. When upgrading using the Skip Software Version method, it’s possible to jump directly from 10.1.12 to 11.1.13. However, when downgrading, why is it necessary to go through 11.0, 10.2, and then 10.1?

Based on this KB, I’m not sure whether it is actually possible to downgrade directly from 11.1.13 back to 10.1.12 in a single step.

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/downgrade-pan-os/downgrade-a-firewall-to-a-previous-feature-release

There is a note in the KB stating that: "To downgrade from PAN-OS 11.1 to an earlier PAN-OS release, you must download and install PAN-OS 10.1.3 or later PAN-OS 10.1 release before you can continue on your downgrade path to your target PAN-OS release. Downgrade from PAN-OS 11.1 fails if you attempt to downgrade to PAN-OS 10.1.2 or earlier PAN-OS 11.1 release."

Thank you.

Re: Upgrade from 10.1.12 to 11.1.13

TomYoung — Thu, 26 Mar 2026 19:08:35 GMT

Hi @Sathaporn ,

Cool! That is better than the documents that I found. Yours must be newer.

Thanks,

Tom