article Support FAQ: Upgrading PAN-OS and Upgrade Paths in Support FAQ https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/ta-p/590319 <P><SPAN>Let’s discuss upgrading your PAN-OS. It might sound routine, but without proper planning, it can turn into a real nightmare.</SPAN></P> <P><SPAN>&nbsp;</SPAN></P> <P><SPAN>Consider this: Do you actually need to upgrade?</SPAN></P> <P><SPAN>&nbsp;</SPAN></P> <P><SPAN>On many occasions, I talked with customers that were upgrading just for the sake of upgrading. Think about these first: Do you absolutely need the new features from the latest release, or are the current ones meeting your needs just fine? Are you happy with how stable your current version is running? Are you actually vulnerable to the vulnerability that was addressed in the newer version? Installing the latest releases can come with risks.&nbsp;</SPAN></P> <P><SPAN>&nbsp;</SPAN></P> <P><SPAN>Knowing why you're upgrading and understanding the potential impacts is crucial. Maybe you’re ironing out bugs with a maintenance release or unlocking new features with a major update. Either way, your first stop should be the release notes—they’re your goldmine for all the updates and fixes.</SPAN></P> <P>&nbsp;</P> <P>&nbsp;</P> <H4><STRONG>Utilizing Feature Guides and Security Advisories</STRONG><SPAN><BR /><BR /></SPAN></H4> <P><SPAN>Leverage the available resources such as the Feature Guide and Security Advisories. These tools offer detailed insights into new features, bug fixes, and security patches for each release.</SPAN><SPAN><BR /></SPAN><SPAN><BR /></SPAN><SPAN>TechDocs: </SPAN><A href="https://docs.paloaltonetworks.com/release-notes" target="_blank" rel="noopener"><SPAN>Release Notes</SPAN></A></P> <P><SPAN>TechDocs: </SPAN><A href="https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features" target="_blank" rel="noopener"><SPAN>PAN-OS New Features Guide</SPAN></A></P> <P><SPAN>LIVEcommunity: </SPAN><A href="https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304" target="_blank" rel="noopener"><SPAN>PAN-OS Software Release Guidance</SPAN></A></P> <P>&nbsp;</P> <P>&nbsp;</P> <H4><STRONG>Navigate Release Notes for Critical Updates&nbsp;</STRONG></H4> <P>&nbsp;</P> <P><SPAN>Skimming through the release notes can save you from unpleasant surprises. Changes in default behavior and new features could mean significant shifts in how things work. A feature that behaved one way in version A might behave differently in version B.</SPAN></P> <P><SPAN>&nbsp;</SPAN></P> <P><SPAN>TechDocs: </SPAN><A href="https://docs.paloaltonetworks.com/pan-os/11-2/pan-os-release-notes/changes-to-default-behavior/changes-to-default-behavior-in-pan-os-11-2" target="_blank" rel="noopener"><SPAN>Changes to Default Behavior in PAN-OS 11.2</SPAN></A></P> <P>&nbsp;</P> <P>&nbsp;</P> <H4><STRONG>Upgrade Considerations and Compatibility Checks</STRONG></H4> <P>&nbsp;</P> <P><SPAN>Additionally you’ll need to look into the upgrade/downgrade considerations. These will help you prepare for any unexpected twists and ensure you’re ready for anything. It’s also essential to check the support matrix to confirm that all integrated products—like GlobalProtect clients and various plugins—are compatible with your new version.</SPAN></P> <P><SPAN>&nbsp;</SPAN></P> <P><SPAN>TechDocs: </SPAN><A href="https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgradedowngrade-considerations" target="_blank" rel="noopener"><SPAN>Upgrade/Downgrade Considerations</SPAN></A></P> <P><SPAN>TechDocs: </SPAN><A href="https://docs.paloaltonetworks.com/compatibility-matrix" target="_blank" rel="noopener"><SPAN>Palo Alto Networks Compatibility Matrix</SPAN></A></P> <P>&nbsp;</P> <P>&nbsp;</P> <H4><STRONG>Preparation Strategies for Firewall Upgrades</STRONG></H4> <P><SPAN>&nbsp;</SPAN></P> <P><SPAN>Preparation is the name of the game. Think of it like getting ready for a big match. You wouldn't jump in without warming up, right? The same goes for your firewall upgrade. Back up your configurations, capture tech support files before and after the upgrade, and take detailed snapshots like routing tables and interface statuses. This ensures you can revert to a previous state if something goes wrong. Schedule time for application testing and have a rollback plan in place, just in case.</SPAN></P> <P><SPAN><BR /></SPAN><SPAN>If possible, test the upgrade in a lab environment to catch any potential issues before they affect your production systems.</SPAN></P> <P><SPAN><BR /></SPAN><SPAN>Plan to perform the upgrades during off-peak hours to minimize the impact on your users.</SPAN></P> <P><SPAN>&nbsp;</SPAN></P> <P><SPAN>TechDocs: </SPAN><A href="https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/firewall-administration/manage-configuration-backups" target="_blank" rel="noopener"><SPAN>Manage Configuration Backups</SPAN></A></P> <P><SPAN>KB: </SPAN><A href="https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oNeJCAU&amp;lang=en_US" target="_blank" rel="noopener"><SPAN>How to Generate a Tech Support File via CLI</SPAN></A></P> <P><SPAN>TechDocs: </SPAN><A href="https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-upgrade/upgrade-pan-os/downgrade-pan-os" target="_blank" rel="noopener"><SPAN>Downgrade PAN-OS</SPAN></A></P> <P><SPAN>&nbsp;</SPAN></P> <P>&nbsp;</P> <H4><STRONG>Executing Firewall Upgrades</STRONG></H4> <P>&nbsp;</P> <P><SPAN>When it’s time to execute the upgrade, stick to your plan. Avoid shortcuts and keep in mind that network changes are expected. This is especially true in high availability setups. Pre-upgrade state information can be a lifesaver if you need to troubleshoot later. If you have a high availability environment, test failover before diving into the upgrade to ensure everything’s working as it should. Start with one firewall to validate that everything's functioning properly before committing fully.</SPAN></P> <P><SPAN>&nbsp;</SPAN></P> <P><SPAN>TechDocs: </SPAN><A href="https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/high-availability/set-up-activepassive-ha/verify-failover" target="_blank" rel="noopener"><SPAN>Verify Failover</SPAN></A></P> <P><SPAN>&nbsp;</SPAN></P> <P>&nbsp;</P> <H4><SPAN>Critical Considerations in Choosing Your Upgrade Path</SPAN></H4> <P>&nbsp;</P> <P><SPAN>When it comes to actually upgrading your PAN-OS, choosing the right upgrade path is absolutely critical.&nbsp;</SPAN></P> <P><SPAN>&nbsp;</SPAN></P> <P><SPAN>How to Select the Right Upgrade Path:</SPAN></P> <P>&nbsp;</P> <OL> <LI style="font-weight: 400;" aria-level="1"><STRONG>Identify Your Current Version</STRONG><SPAN><BR /></SPAN><SPAN><BR /></SPAN><SPAN>Start by pinpointing your current PAN-OS version. You can find this information in the General Information section of your dashboard. Knowing your starting point is crucial for planning the upgrade journey.</SPAN><SPAN><BR /><BR /></SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><STRONG>Understand the Release Sequence</STRONG><SPAN><BR /></SPAN><SPAN><BR /></SPAN><SPAN>PAN-OS versions are structured in a sequence denoted as X.Y.Z (for example, 10.0.5):</SPAN><SPAN><BR /></SPAN><SPAN><BR /></SPAN><SPAN>X is the major software release number.</SPAN><SPAN><BR /></SPAN><SPAN>Y is the feature version release.</SPAN><SPAN><BR /></SPAN><SPAN>Z is the maintenance release number.</SPAN><SPAN><BR /></SPAN><SPAN><BR /></SPAN><SPAN>Each major version begins with a base image (x.x.0), which contains the core functionalities. Subsequent maintenance releases (x.x.1, x.x.2, etc.) focus on bug fixes and incremental improvements.</SPAN><SPAN><BR /><BR /></SPAN></LI> <LI style="font-weight: 400;" aria-level="1"><STRONG>Plan the Upgrade Steps</STRONG><SPAN><BR /></SPAN><SPAN><BR /></SPAN><SPAN>You can find detailed steps of the preferred upgrade paths here:</SPAN><SPAN><BR /><BR /></SPAN></LI> <OL> <LI style="font-weight: 400;" aria-level="2"><A href="https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path" target="_blank" rel="noopener"><SPAN>Determine the Upgrade Path to PAN-OS 10.1</SPAN></A></LI> <LI style="font-weight: 400;" aria-level="2"><A href="https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path" target="_blank" rel="noopener"><SPAN>Determine the Upgrade Path to PAN-OS 10.2</SPAN></A></LI> <LI style="font-weight: 400;" aria-level="2"><A href="https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path" target="_blank" rel="noopener"><SPAN>Determine the Upgrade Path to PAN-OS 11.0</SPAN></A></LI> <LI style="font-weight: 400;" aria-level="2"><A href="https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path" target="_blank" rel="noopener"><SPAN>Determine the Upgrade Path to PAN-OS 11.1</SPAN><SPAN><BR /><BR /></SPAN></A></LI> </OL> </OL> <P><SPAN>NOTE: You can now use the </SPAN><A href="https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features/management-features/skip-software-version-upgrade" target="_blank" rel="noopener"><SPAN>Skip Software Version Upgrade</SPAN></A><SPAN> feature to skip software versions when upgrading your device from PAN-OS 10.1 or later releases.</SPAN><SPAN><BR /></SPAN><SPAN><BR /></SPAN><SPAN>LIVE: </SPAN><A href="https://live.paloaltonetworks.com/t5/general-topics/upgrade-pan-os-from-10-1-to-11-1/m-p/578600#M116041" target="_blank" rel="noopener"><SPAN>Upgrade PAN OS from 10.1 to 11.1</SPAN><SPAN><BR /></SPAN></A><SPAN>LIVE: </SPAN><A href="https://live.paloaltonetworks.com/t5/panorama-configuration/panorama-from-10-2-8-to-11-1-x/m-p/588331#M839" target="_blank" rel="noopener"><SPAN>Panorama from 10.2.8 to 11.1.x</SPAN></A></P> <P><SPAN>&nbsp;</SPAN></P> <H4><STRONG><BR /></STRONG><STRONG>Post-Upgrade Validation for Firewall Stability</STRONG></H4> <P>&nbsp;</P> <P><SPAN>Once the upgrade is complete, don’t forget to validate that everything is working correctly. This part varies greatly on your setup. Data centers might need extensive application testing, while smaller setups could get by with basic checks. Start with the dashboard to assess the overall health of the firewall. Check system logs for any irregularities and review session and traffic logs to ensure normal operation. For critical environments, comparing pre- and post-upgrade data helps maintain consistency and prevents any surprises down the road.</SPAN></P> <P><SPAN><BR /><BR /></SPAN></P> <H4><STRONG>Additional Resource Links:</STRONG></H4> <P>&nbsp;</P> <P><A href="https://live.paloaltonetworks.com/t5/general-topics/best-practices-for-pan-os-upgrade-without-downtime/td-p/149308" target="_blank" rel="noopener"><SPAN>Forum: Best Practices for PAN-OS Upgrade Without Downtime</SPAN></A></P> <P><A href="https://live.paloaltonetworks.com/t5/general-articles/upgrading-pan-os-versions/ta-p/520912" target="_blank" rel="noopener">Article: Upgrading PAN-OS Versions</A></P> <P><A href="https://live.paloaltonetworks.com/t5/community-blogs/best-practices-for-palo-alto-networks-devices/ba-p/558505" target="_blank" rel="noopener">Blog: Best Practices for Palo Alto Networks Devices</A></P> <P><A href="https://live.paloaltonetworks.com/t5/community-blogs/dotw-determining-which-code-is-right-for-you/ba-p/507180" target="_blank" rel="noopener">Blog: Determining Which Code is Right for You </A></P> <P><A href="https://live.paloaltonetworks.com/t5/pancast-episodes/pancast-episode-1-four-things-you-must-do-when-upgrading-your/ta-p/515952" target="_blank" rel="noopener">PodCast: PANCast Episode 1 - Four Things You Must Do When Upgrading Your Firewall</A></P> <P>&nbsp;</P> <P>&nbsp;</P> Thu, 27 Jun 2024 10:33:37 GMT kiwi 2024-06-27T10:33:37Z Support FAQ: Upgrading PAN-OS and Upgrade Paths https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/ta-p/590319 <P>LIVEcommunity's Support FAQ<SPAN>&nbsp;provide clear, comprehensive resources that address customers' most common issues. Here's what you need to know about Upgrading PAN-OS and Upgrade Paths.</SPAN></P> Thu, 27 Jun 2024 10:33:37 GMT https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/ta-p/590319 kiwi 2024-06-27T10:33:37Z Re: Support FAQ: Upgrading PAN-OS and Upgrade Paths https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/593842#M6 <P>Hi all,</P><P>&nbsp;</P><P>we are currently on 10.2.8-h3 and want goto 11.1.2-h3.</P><P>&nbsp;</P><P>what is the best way to upgrade ?&nbsp; searching through the forum and seem to have different approach.</P><P>&nbsp;</P><P>download 11.0.0</P><P>download 11.0.4.-h2 (Prefered version)/install/reboot</P><P>download 11.1.0</P><P>download 11.1.2-h3/install/reboot</P><P>&nbsp;</P><P>(some suggest download 10.2.9-h1/install/reboot?)</P><P>Any advise much appreciated.</P><P>QL</P><P>&nbsp;</P> Fri, 02 Aug 2024 02:49:52 GMT https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/593842#M6 Qui 2024-08-02T02:49:52Z Re: Support FAQ: Upgrading PAN-OS and Upgrade Paths https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/593983#M7 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/32779">@Qui</a>&nbsp;,</P> <P>&nbsp;</P> <P><SPAN>If you are already running a PAN-OS 10.2 release, you can&nbsp;</SPAN><A class="xref" title="" href="https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os.html#id731a388f-23d0-4a65-a776-b8062f4ea093" target="_self" data-scope="local" data-format="dita" data-type="">upgrade directly to PAN-OS 11.1</A></P> <P>&nbsp;</P> <DIV>Just ensure that the firewall is running the latest content release version.</DIV> <P><LI-WRAPPER></LI-WRAPPER></P> <DIV class="itemgroup info" data-label="ADDITIONAL INFORMATION"> <DIV> <DIV class="p"> <DIV>Refer to the<SPAN>&nbsp;</SPAN><A class="xref" title="" href="https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes.html" target="_blank" rel="noopener" data-scope="external" data-format="html" data-type="">Release Notes</A><SPAN>&nbsp;</SPAN>for the minimum content release version you must install for a PAN-OS 11.1 release.</DIV> </DIV> </DIV> </DIV> <P>&nbsp;</P> <P>Source:&nbsp;<A href="https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path#id85bdf6f4-2e83-49f0-8525-3eb2163f2d2e" target="_blank">https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path#id85bdf6f4-2e83-49f0-8525-3eb2163f2d2e</A></P> <P>From Panorama:&nbsp;<A href="https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os-from-panorama#id63caf725-838b-420c-a955-9efd4b75dace" target="_blank">https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os-from-panorama#id63caf725-838b-420c-a955-9efd4b75dace</A></P> <P>&nbsp;</P> <P>&nbsp;</P> Mon, 05 Aug 2024 07:53:22 GMT https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/593983#M7 kiwi 2024-08-05T07:53:22Z Re: Support FAQ: Upgrading PAN-OS and Upgrade Paths https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/594059#M8 <P>Hi Kiwi,</P><P>We did a long way via 10.2.9-h1 as suggested by a another member and it worked nicely for us.</P><P>A bit worry of this direct approach.</P><P>Thank you .</P> Mon, 05 Aug 2024 23:24:34 GMT https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/594059#M8 Qui 2024-08-05T23:24:34Z Re: Support FAQ: Upgrading PAN-OS and Upgrade Paths https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/594566#M9 <P>Hello,<BR />Currently we are on 110.4.h2,<BR />I need path upgrade to 11.1.2 or later versions.<BR />NOTE: Running HA<BR /><BR />I appreciate your help..</P> Sat, 10 Aug 2024 07:35:43 GMT https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/594566#M9 Kardokh 2024-08-10T07:35:43Z Re: Support FAQ: Upgrading PAN-OS and Upgrade Paths https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/594596#M10 <P>Hi <a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/287534">@Kardokh</a> ,</P> <P>&nbsp;</P> <P>Since you're already running PAN-OS 11.0, you can <A class="xref" title="" href="https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os.html#id731a388f-23d0-4a65-a776-b8062f4ea093" target="_self" data-scope="local" data-format="dita" data-type="">upgrade directly to PAN-OS 11.1</A></P> <P>&nbsp;</P> <P>You can follow the set of instructions for <A href="https://docs.paloaltonetworks.com/content/techdocs/en_US/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/upgrade-an-ha-firewall-pair.html#id062f1ad5-adb3-4d25-b4a4-529bde5dc96a" target="_blank" rel="noopener">Upgrade an HA Firewall Pair</A></P> <P>&nbsp;</P> <P>Cheers,</P> <P>-Kim.</P> <P>&nbsp;</P> Mon, 12 Aug 2024 08:35:33 GMT https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/594596#M10 kiwi 2024-08-12T08:35:33Z Re: Support FAQ: Upgrading PAN-OS and Upgrade Paths https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/1086642#M14 <P>So I can go directly from 10.2.9-h1 to 11.1.4-h7?</P> Thu, 16 Jan 2025 20:33:33 GMT https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/1086642#M14 Chris_A 2025-01-16T20:33:33Z Re: Support FAQ: Upgrading PAN-OS and Upgrade Paths https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/1234356#M21 <P>PAN-OS 11.1.6-h10 Addressed Issues&nbsp;</P><P>how to know which is the minimum content-version or app-version for this release [ 11.1.6-h10 ]</P><P>&nbsp;</P> Mon, 21 Jul 2025 10:43:43 GMT https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/1234356#M21 omkar 2025-07-21T10:43:43Z Re: Support FAQ: Upgrading PAN-OS and Upgrade Paths https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/1235347#M22 <P><a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/1059362323">@omkar</a>&nbsp;,</P> <P>&nbsp;</P> <P>You can find this information in the Associated Content and Software versions:</P> <P><A href="https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/associated-content-and-software-versions/associated-content-and-software-versions-for-pan-os-11-1" target="_blank">https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/associated-content-and-software-versions/associated-content-and-software-versions-for-pan-os-11-1</A></P> <P>&nbsp;</P> <P>Hope this helps,</P> <P>-Kim.</P> Mon, 04 Aug 2025 12:50:21 GMT https://live.paloaltonetworks.com/t5/support-faq/support-faq-upgrading-pan-os-and-upgrade-paths/tac-p/1235347#M22 kiwi 2025-08-04T12:50:21Z