topic Re: Upgrade path from 9.1.x to 10.1 in General Topics

Upgrade path from 9.1.x to 10.1

HarryNoStyles — Wed, 08 Feb 2023 19:37:00 GMT

Hello,

I need some help verifying that the below upgrade process from 9.1.x to 10.1.x is correct way.

1. Upgrade to the latest 9.1.x release

2. Download/install 10.0.0 base

3. Upgrade to the latest 10.0.0 relase

4. Download/install 10.1.0 base

5. Upgrade to the preferred 10.1.x release

Thank you!

Re: Upgrade path from 9.1.x to 10.1

TomYoung — Wed, 08 Feb 2023 20:51:28 GMT

Hi @HarryNoStyles ,

That's pretty close. Here are the modified steps:

Upgrade to the preferred 9.1 release.
Download 10.0 base. No install needed.
Download/install preferred10.0 release.
Download 10.1 base. No install needed.
Download/install preferred10.1 release.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path#id85bdf6f4-2e83-49f0-8525-3eb2163f2d2e

The link to the TAC preferred versions can be found in the URL above.

As always, install the latest dynamic updates and review the Upgrade/Downgrade Considerations (link also in URL above) before upgrading.

Thanks,

Tom

Re: Upgrade path from 9.1.x to 10.1

HarryNoStyles — Wed, 08 Feb 2023 22:35:17 GMT

Thank you!!

Re: Upgrade path from 9.1.x to 10.1

Manu_P — Wed, 12 Jul 2023 12:48:42 GMT

Hello, i'm finding myself in the same boat - i have to upgrade from 9.1.x. to 10.1.x (running a standalone HA active/passive PA-3220 pair)

The thing that bugs me, albeit rather slightly is the fact that 10.0.12 is listed the preferred 10.0 release, yet my firewalls latest downloadable option is 10.0.11-h1 dated 2022/08/17.

Any possible issues? Should i go 9.1.16 > 10.0.0 + 10.0.11-h1 > 10.1.0 + 10.1.10? (not like i have any other option currently, not even the customer support is listing 10.0.12, so i cannot manually download that version)

Re: Upgrade path from 9.1.x to 10.1

kiwi — Thu, 13 Jul 2023 11:07:09 GMT

Hi @HarryNoStyles ,

If you're missing PAN-OS 10.0.12 then your proposed path would be the way to go yes. I don't see any issues in doing that.

FYI, I am seeing PAN-OS 10.0.12-h1 in the support portal (tested for 5200 and 3200 platforms):

Kind regards,

-Kim.

Re: Upgrade path from 9.1.x to 10.1

Manu_P — Thu, 13 Jul 2023 12:01:32 GMT

Thanks for reply, but that's not what i'm seeing in my Customer Portal

Re: Upgrade path from 9.1.x to 10.1

Karl — Mon, 21 Aug 2023 11:03:10 GMT

Hello,

It seems not to have anymore a preferred release for the 10.0 version. Should we consider using the last release version (10.0.11-h1) ?

Another point that questions me. The preferred version of the 9.1 release is 9.1.16 (released on 2023/04/05). The last release of 10.0 version ( 10.0.11-h1) was published on 2022/08/17. There is no problem to upgrade the Firewall with an "older" version of PAN-OS ?

Regards,

Karl

Re: Upgrade path from 9.1.x to 10.1

Manu_P — Mon, 21 Aug 2023 11:25:06 GMT

Nope, no issues.

We went 9.1.16 > 10.0.11-h1 > 10.1.10 (preferred version at the time) with no issues

The process was something like this (we have a pair in ha active/passive and i did saved and exported the config from each node prior to each upgrade):

Secondary (passive): Download 10.0.0

Secondary (passive): Download 10.0.11-h1

Secondary (passive): Install 10.0.11-h1, reboot

Secondary running 10.0.11-h1, made active after reboot

Primary (passive): Download 10.0.0

Primary (passive): Download 10.0.11-h1

Primary (passive): Install 10.0.11-h1, reboot

Primary (passive): Download 10.1.0

Primary (passive): Download 10.1.10

Primary (passive): Install 10.1.10, reboot

Primary running 10.1.10, made active after reboot

Secondary (passive): Download 10.1.0

Secondary (passive): Download 10.1.10

Secondary (passive): Install 10.1.10, reboot

Everything went smooth, but it did take quite some time

Re: Upgrade path from 9.1.x to 10.1

ZacRagoonath — Wed, 23 Aug 2023 13:47:40 GMT

Good day, My first PA upgrade - coming from a Cisco background.
I'm unclear on the requirement to download the base for eg 10.0 but only isntall the preferred say 10.4 release.

If I'm on the latest 9.x release, should I not download AND install the 10.0 version ?

Re: Upgrade path from 9.1.x to 10.1

Doug_Kershner — Wed, 23 Aug 2023 16:46:27 GMT

I've seen this discussed in other threads but no one gets specific enough

And that is the relationship between Panorama OS and the firewalls associated with it. People say same version or less, others say you can use higher OS's as long as they are 10.1.x (for instance 10.1.9)

So if Panorama is running 10.1.5.h-2 can you run the PA-220s on 10.1.9 or should I stick with 10.1.5.h-2? Best practice?

Re: Upgrade path from 9.1.x to 10.1

Manu_P — Thu, 24 Aug 2023 07:36:04 GMT

Hi there,

you need to download the base version (no install), then download & install the preferred maintenance version

during the upgrade process you cannot skip any version, see the opening post or my own example (this was eased out in 11.0 which allows to skip versions )

If you are on latest 9.x release you just need to follow the steps in the opening post.

If you are running an HA setup with 2 nodes, you need to follow the steps i provided in a post above