topic Re: Revert back a 6 OS from 7 OS in General Topics

Revert back a 6 OS from 7 OS

jdprovine — Tue, 31 May 2016 20:22:16 GMT

Has anyone had to revert back from an upgrade? Especial from 7 OS from a 6 OS? If so how did you do it and how easy was it? I am preparing to move from 6.1.10 to 7.06 and I want to make sure that I cover every possible scenario. Luckily I have a secondary that I can try it on first.

Can you revert back and reinstall the previous OS that you upgraded from?

Can you do a factory reset and reload the recent configuration that you exported before upgrading?

Any ideas you have would be helpful

Re: Revert back a 6 OS from 7 OS

Brandon_Wertz — Tue, 31 May 2016 20:39:58 GMT

I haven't done it, maybe others have and can provide realworld info on the subject. However as I understand it, you're only going to run into an issue if you implement/use some new policy feature that exists in version 7.0.X that didn't in the prior 6.1.X version.

So as long as you're just doing a simple upgrade and not implement anything new a revert should be ok. Again, that's just my basic understanding.

Re: Revert back a 6 OS from 7 OS

Raido_Rattameister — Tue, 31 May 2016 22:57:21 GMT

It is always good practice to export config out and have it on hard drive before upgrades.

If you forget this step and want to revert back then just load old config in firewall (Palo keeps last 100 configs on disk) and use command debug swm revert.

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Downgrade-PAN-OS/ta-p/58664

Re: Revert back a 6 OS from 7 OS

reaper — Wed, 01 Jun 2016 09:21:52 GMT

if you did your upgrade in one go (so 6.1.10 -> 7.0.6 NOT 6.1.10 -> 7.0.0 -> 7.0.6) , you can simply revert using the swm debug command:

> debug swm status

Partition         State             Version
--------------------------------------------------------------------------------
sysroot0          REVERTABLE        7.0.5
sysroot1          RUNNING-ACTIVE    7.1.1
maint             READY             7.1.1

> debug swm revert

Re: Revert back a 6 OS from 7 OS

pankaku — Wed, 01 Jun 2016 15:42:38 GMT

Before you upgrade take the config back.

We can revert by the help of following commands:

debug swm status
debug swm revert

If above command doesn't help the we can try a factory reset and then can load the saved config.

Re: Revert back a 6 OS from 7 OS

Anon1 — Wed, 01 Jun 2016 20:21:34 GMT

Please note that there is currently the situation that you cannot directly upgrade from 6.1.10 to 7.0.6, provided this applies to your environment.

See warning in release notes:

https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os-release-notes/pan-os-7-0-6-addressed-issues

Before you upgrade to PAN-OS 7.0.3 or a later PAN-OS 7.0 release, you should review the information about how to upgrade a firewall to PAN-OS 7.0. Additionally, if virtual system (vsys) configuration is not enabled on your firewall or appliance, you must reboot your firewall or appliance after you install PAN-OS 7.0.1 and before you upgrade to PAN-OS 7.0.3 or a later release.

So you would need to install 7.0.1, reboot, then install 7.0.6 and reboot again. However, then the 6.1.10 is no longer available in the partition and simple revert is not possible.

Re: Revert back a 6 OS from 7 OS

jdprovine — Thu, 02 Jun 2016 13:14:50 GMT

Really I also opened a case we tac and they did not mention that, thanks for the info I will add that as a question on my ticket

Re: Revert back a 6 OS from 7 OS

Raido_Rattameister — Fri, 03 Jun 2016 20:25:04 GMT

By the way downgrade is even easier as autosave config is taken during upgrade.

https://www.paloaltonetworks.com/documentation/71/pan-os/newfeaturesguide/upgrade-to-pan-os-7-1/downgrade-to-a-previous-feature-release#59357