topic Re: Third-party SFP transceivers in General Topics

Third-party SFP transceivers

PaulBrock — Tue, 20 Mar 2018 04:46:20 GMT

Hi Everyone,

i am currently running 7.1.14 and am looking to upgrade to 8.08 with third part trancivers

HPE X242 10G SFP+ to SFP+ 3m Direct Attach Copper Cable J9283B

I read in the Upgrade/Downgrade Considerations Support for Third-Party SFP Transceivers

https://www.paloaltonetworks.com/documentation/81/pan-os/newfeaturesguide/upgrade-to-pan-os-81/upgradedowngrade-considerations#id0593bb6c-d14c-4458-870a-0c39cc9c4539

that to not upgrade to 8.0 or 8.1 unless you then upgrade to a maintenance release that contains the fix for this issue.

also it states

Additionally, when you are ready to upgrade, make sure that you do not reboot the firewall after you download and install the PAN-OS 8.1 (or PAN-OS 8.0) base image until after you download and install a maintenance release that contains the fix for this issue.

My question is

How do i know if there is a maintenaince release ideally 8.06 that contains the fix?

and also is it possible to upgrade to 8.0 and the to 8.06 without restarting?

Re: Third-party SFP transceivers

rmfalconer — Tue, 20 Mar 2018 16:58:47 GMT

You should probably open a TAC case to check on the compatability of the transcievers. I'm using a 3rd party transciever on 8.0.6 in production but I tested the brand in a lab before upgrading production.

You can't get to 8.0.6 without a reboot. Current best-practice to upgrade from 7.1.14 to 8.0.6 would be to install the latest 7.1 and reboot, take a snapshot for rollback, install 8.0 and reboot and then 8.0.8 and reboot.

Re: Third-party SFP transceivers

gwesson — Tue, 20 Mar 2018 17:21:03 GMT

TAC won't be able to help here I'm afraid. If it's not the exact models sold by PAN, it may work but may not. Support will not check compatibility of transceivers that aren't sold by Palo Alto Networks. The official 3rd party policy is here:

https://www.paloaltonetworks.com/services/support/support-policies/third-party-components-support

As for the question regarding whether 8.0.6 contains the fix, it does not. You can always look at the release notes for any version to see fixes up-to and including that version. In this instance, the links at the bottom of the Upgrade/Downgrade block that @PaulBrock linked to show the transceiver issue mentioned as PAN-92564. That issue ID is a known issue in 8.1.0 and the latest version of 8.0 (8.0.8). Since it is in the "known issue" section it does not yet have a fix available. When a known issue is fixed, future release notes show what version contains that fix in both the Known Issues section and the Issues Resolved in this Release section.

Regarding the reboot question, the caveat listed is "Additionally, after we provide a release with this fix and you begin the upgrade process, you must not reboot the firewall after you download and install the PAN-OS 8.0 base image until after you download and install the maintenance release with this fix."

What that means is when you do decide to upgrade from 7.1 to 8.0, you just need to download the 8.0.1 base image but NOT reboot. Instead, download the version that contains the fix (whatever version that ends up being) immediately after downloading 8.0.1. Then reboot to the fixed version.

Hopefully this clarifies things a bit!

-Greg Wesson

Re: Third-party SFP transceivers

PaulBrock — Tue, 20 Mar 2018 20:58:17 GMT

Thankyou both for taking the time to respond in a very detailed manner, I have also opened a case with TAC and have just got back the following response

PAN-92564 .
It's not yet resolved in 8.0.8. Fix is planned for 8.0.9 release which is due for release by end of this month.

Fingers crossed .

I am curious what other people use in regards to 3rd party transceiver

My firewall connects into a HPE switch which only accepts HP branded trancivers using 10gb DAC, so therefore I was allways grateful PA is transceiver agnostic .

Paul

Re: Third-party SFP transceivers

bryton.yang — Fri, 14 Mar 2025 02:07:18 GMT

Gwesson hi~

I just noticed PANW no longer supports third-party peripherals, meaning the use of third-party devices such as transceivers will affect the RMA warranty. Do you know when this notice was issued, or does anyone have any information about it?

Third Party Components Support - Palo Alto Networks