topic Re: upgrading PAN-OS in General Topics

upgrading PAN-OS

Ndexsystems — Mon, 18 Sep 2023 15:36:13 GMT

I want to upgrade the 8.1.x to the latest version , after two upgrade stay on 8.1.24. I tried to move to 9.0.X but failed. Could you please let me know how I can upgrade to 9.x? (As information that I have find need the Preferred release It means 8.1.25, but I cann't find it)

Thanks

Re: upgrading PAN-OS

A_Astardzhiev — Mon, 18 Sep 2023 17:33:33 GMT

Hi @Ndexsystems ,

Palo Alto upgrade path is listed here - https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/determine-the-upgrade-path

As mentioned from the link above it is recommended (not acutally mandatory) to upgrade first to the latest maintenance release.

As described here - https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304 8.1 is End-of-Life, except for some hardware platforms. So if there is no 8.1.25, it means such is not available for your device.

Upgrading from 8.1.24 to 9.0 shouldn't be a problem. If you upgrade from 8.1 to 9.0 has failed I would suggest to troubleshoot the reason. Can you share more details of the failed upgrade and why you decided to roll back to 8.1?

Re: upgrading PAN-OS

Ndexsystems — Mon, 18 Sep 2023 17:55:09 GMT

I don't want to roll back to 8.1 , going for last version 11 .. this is error message that I received when upgrading to 9.0.0: "Upgrading from 8.1.24 to 9.0.0 requires content version of 8103 or greater and found 769-4439 "

Re: upgrading PAN-OS

A_Astardzhiev — Mon, 18 Sep 2023 18:35:04 GMT

Hi @Ndexsystems ,

The error message should be self-explainatory - every major upgrade requires minimum supported version for dynamic content updates. This is also explained here - https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-pan-os/pan-os-upgrade-checklist

Verify the minimum content release version.

Minumum content release version is listed in the release notes for each major version - https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-release-information/associated-software-and-content-versions

My personal opinion is to always keep the content version to the latest, so instead of installing the minimum, just update the content update to the latest available.

Does your FW has internet connection? Does it has valid support license? If yes, you can update the content update directly from the firewall.

If no intenet connection, you can download content update from support portal and upload it manually.

Re: upgrading PAN-OS

daubsi — Fri, 20 Dec 2024 18:58:12 GMT

I am running in exactly this problem that upgrading from 8.1.x to 9.0 required at least a content update pack of version 8103, however the firewall still has an ancient 3-digit version content pack, apparently from 8.0. I installed the FW to the latest 8.1.26-h2 software update, but am stuck here now. While the support portal let's me download all software version for the last 4+ years, the content pack versions offered are only those from the last two month. I tried installing the oldest content pack available in the portal (8916-9089), but the upload just stays there saying "uploading" for 30 minutes without any progress. Is there a way to get hold of the minimum required version 8103 so I can bring the FW to v9.0.0 and keep upgrading from there?

Re: upgrading PAN-OS

BPry — Mon, 23 Dec 2024 16:14:30 GMT

@daubsi,

You'll want to call TAC and get 8103 from them. Once you have that installed, you should be able to update to 8916 and then get back into automatic updates.

Re: upgrading PAN-OS

MDauberschmidt — Thu, 26 Dec 2024 10:15:29 GMT

Thank you, after rebooting/reloading the Admin UI the upload of 8916 actually also worked without prior installation of a 4-digit pattern and the update process continued from there without issues.

Re: upgrading PAN-OS

OtakarKlier — Fri, 27 Dec 2024 18:22:06 GMT

Hello,

Things that get over looked are the Dynamic updates are up to date. Also when on the Software menu, always make sure to hit the 'Check Now' in the lower left. This will display all the newest and available options.

Even if the version you want is listed and you try and install it, it could fail. 'Check Now' usually resolves this.

Regards,