topic Re: Upgrade from version 10.2.7-h8 to 10.2.11-h2 in General Topics

Upgrade from version 10.2.7-h8 to 10.2.11-h2

F.Basco — Mon, 18 Nov 2024 11:10:28 GMT

Hi, could you help me?
I should make a release change from version 10.2.7-h8 to 10.2.11-h2
for palo alto 3440. The two firewalls are in HA
Can you tell me the various release jumps I should do and if there is a procedure to follow?

Re: Upgrade from version 10.2.7-h8 to 10.2.11-h2

Raido_Rattameister — Mon, 18 Nov 2024 13:37:51 GMT

I would install 10.2.11-h2 on passive, reboot passive.

After passive comes back online and is healthy then install and reboot active one.

No need to install intermediate versions.

When active goes for reboot then active role will be automatically handed over to other firewall.

But what made you choose specifically 10.2.11-h2 version? TAC suggestion?

Re: Upgrade from version 10.2.7-h8 to 10.2.11-h2

F.Basco — Mon, 18 Nov 2024 14:07:57 GMT

Thanks for your immediate and precise response...
I chose this release because it allows me to circumvent (second high pole) CVE vulnerabilities.
I take advantage of your kindness, do you also have a link or Procedure/document that I could follow during the upgrade?

Re: Upgrade from version 10.2.7-h8 to 10.2.11-h2

Raido_Rattameister — Mon, 18 Nov 2024 14:30:00 GMT

Today TAC preferred version is 10.2.10-h7

https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304

Official upgrade guide can be found at https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/upgrade-an-ha-firewall-pair#id062f1ad5-adb3-4d25-b4a4-529bde5dc96a

Also look into 10.2.12-h2 as according to https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/upgrade-an-ha-firewall-pair#id062f1ad5-adb3-4d25-b4a4-529bde5dc96a it mitigates recent management port vulnerability.