topic Re: Downgrade Firewall from 10.0.0 to 9.1.1 in General Topics

Downgrade Firewall from 10.0.0 to 9.1.1

RovshanRajabli — Fri, 18 Nov 2022 09:00:47 GMT

Greeting Team!

I noticed some problems with a downgrade in my internal lab. So, some information: I want to downgrade from 10.1.7 to 9.1.1 (i need it for the experiment).

1st step i downgrade from 10.1.7 to 10.0.0, everything fine. But, when I want to downgrade from 10.0.0 to 9.1.1 I faced an error with: Upstream NAT not supported on 9.1.1, please delete it. (i can show it if needed).

I check the information about that, I find some. Like workaround advice to 1st have 10.0.3 or 10.0.4 PAN-OS, then delete upstream NAT from each interface. I try it, but, nothing, cli logs I can show too if needed.

Does somebody face that problem?

Thank you and have a good day!

#downgrade #wm #10.0.0 #9.1.1 #Up-StreamNAT

Re: Downgrade Firewall from 10.0.0 to 9.1.1

reaper — Fri, 18 Nov 2022 09:07:20 GMT

if you're doing this for an experiment on 9.1, you could factory reset your device so you don't have to battle artefacts

Re: Downgrade Firewall from 10.0.0 to 9.1.1

RovshanRajabli — Fri, 18 Nov 2022 09:12:05 GMT

Dear Reaper, thank you for your response.

I need that experiment, cause soon I will do a downgrade on my working firewall. I can`t factory reset my firewall.

Best Regards.

Re: Downgrade Firewall from 10.0.0 to 9.1.1

OtakarKlier — Fri, 18 Nov 2022 22:16:27 GMT

Hello,

Is there a reason you need to downgrade? Is there a bug you are facing? Also which model of Palo Alto are you attempting this on?

Regards,

Re: Downgrade Firewall from 10.0.0 to 9.1.1

RovshanRajabli — Sat, 19 Nov 2022 17:25:59 GMT

Hi Dear Otakar,

Is there a reason you need to downgrade? - I need to be sure, that workaround works, and then apply it on the working firewall

Is there a bug you are facing? - I don't know actually, maybe its a bug, but I can't find information about it.

Also which model of Palo Alto are you attempting this on? - I go WM-50

Re: Downgrade Firewall from 10.0.0 to 9.1.1

OtakarKlier — Tue, 22 Nov 2022 20:29:48 GMT

Hello,

So if the VM is currently running 9.1.x and then you upgrade to 10.1.7, you should be able to downgrade back.

Regards,

Re: Downgrade Firewall from 10.0.0 to 9.1.1

RovshanRajabli — Wed, 23 Nov 2022 05:55:09 GMT

Dear OtakarKlier,

CM currectly running 10.1.x, as i write, i got no trouble with downgrade from 10.1.x to 10.0.x, but from 10.0.x to 9.1.x i faced problem.

Best Regards.

Re: Downgrade Firewall from 10.0.0 to 9.1.1

OtakarKlier — Wed, 23 Nov 2022 22:35:54 GMT

What was the code version the VM was initially deployed on?

Re: Downgrade Firewall from 10.0.0 to 9.1.1

RovshanRajabli — Thu, 24 Nov 2022 05:36:53 GMT

The Code version was 10.1.7 on my VM

Re: Downgrade Firewall from 10.0.0 to 9.1.1

OtakarKlier — Mon, 28 Nov 2022 17:09:15 GMT

If it was deployed at 10.1.7, why downgrade to 9.x.x? I would not recommend downgrading a device, physical or virtual to below what it was initially deployed on, so the lowest in this case would be 10.1.0.