topic Re: want to upgrade to 8.0.X in General Topics

want to upgrade to 8.0.X

MPI-AE — Mon, 12 Feb 2018 15:11:41 GMT

Hey guys,

I have a HA pair of 3020s with 7.1.7

and a single 820 firewall with 8.0.2

Which version can you recommend for the 3020s and the 820?

8.0.5?

8.0.6?

Is there anything to be aware of?

Re: want to upgrade to 8.0.X

kiwi — Mon, 12 Feb 2018 15:19:27 GMT

Hi @MPI-AE,

Currently in the PAN-OS 8.0 branch the recommended version is 8.0.7.

In the PAN-OS 7.1 branch, the recommended version is 7.1.14.

Cheers !

-Kiwi.

Re: want to upgrade to 8.0.X

BPry — Mon, 12 Feb 2018 16:20:22 GMT

@MPI-AE,

If you are looking to upgrade your 3020s to 8.0 then I would recommend going with 8.0.7; I've been running it on my A/P pairs and haven't run into any issues. If you stay on the 7.1 train then go to 7.1.14.

With the 820 I really recommend running 8.0.7 and getting it off of 8.0.2. I'm actually more suprised you haven't had to update already simply to address some of the bugs that people ran into on that specific version.

Re: want to upgrade to 8.0.X

MPI-AE — Wed, 14 Feb 2018 08:30:17 GMT

Thanks you both!

Can I directly upgrade from 7.1.7 to 8.0.7 or is it better first upgrade to 8.0 and after that to 8.0.7?

Re: want to upgrade to 8.0.X

kiwi — Wed, 14 Feb 2018 08:38:12 GMT

Hi @MPI-AE,

As per our best practice guide :

Download 8.0.0 (base version) (Recommended) Install the 8.0 base image and reboot before you install the target maintenance release..
Download and install 8.0.7, and reboot to complete the upgrade.

Full article on best practices for PAN-OS upgrades :

Best-Practices-for-PAN-OS-Upgrade

Cheers !

-Kiwi.

Re: want to upgrade to 8.0.X

MPI-AE — Fri, 16 Mar 2018 14:47:54 GMT

@kiwi

@BPry

will there any impact when I run active fw1 on 8.0.7 along with passive fw2 on 7.1.7 for some days?

Re: want to upgrade to 8.0.X

reaper — Fri, 16 Mar 2018 14:58:09 GMT

the lowest PAN-OS automatically gets priority in a cluster, so you will need to set the passive as suspended, which will cause it to not participate in case of a failure

Re: want to upgrade to 8.0.X

MPI-AE — Fri, 23 Mar 2018 14:12:58 GMT

thank you!
and can you tell me what I need the device state for?

I can't export it, the firewall webinterface always reloads.

Re: want to upgrade to 8.0.X

MPI-AE — Thu, 14 Jun 2018 10:30:06 GMT

Guys, do I have to upgrade my user id agent? my current version is 7.0.2-2.

Will that work with Pan OS 8.0.7?

Re: want to upgrade to 8.0.X

Ben-W — Thu, 14 Jun 2018 10:43:27 GMT

Hi MPE-AE,

Just fyi this information is always included within the release notes found under the software page. Within the release notes: Associated Software and Content Versions

I've had a quick check and can see the minimum supported User-ID™ Agent 8.0.0 is supported for PAN-OS 8.0.x.

kind regards,

Ben

Re: want to upgrade to 8.0.X

MPI-AE — Thu, 14 Jun 2018 10:53:44 GMT

Sorry where can I find that information?

So User ID agent 7.0.2 won't work with PAN OS 8.0.7?

Re: want to upgrade to 8.0.X

Ben-W — Thu, 14 Jun 2018 11:02:22 GMT

Hi MPI-AE,

No worries, so you'll always have release notes for either software or dynamic updates. these can be found by going to support.paloaltonetworks.com (login) and then on the left nav bar check under Updates for software and dynamic updates.

Quick link to software:

https://support.paloaltonetworks.com/Updates/SoftwareUpdates/339

Once you've found the relavent software version you will notice the release notes for each version within the release notes coloumn. Alternatively you can access the release notes from the firewalls themselfs. ( Device > Software ). remember to hit check now to obtain the latest list and corresponding links attached.

So in short the User-ID agent "may" work however it will not be supported as stated by the release notes and would suggest plan to upgrade the agent also.

regards,

Ben

Re: want to upgrade to 8.0.X

MPI-AE — Thu, 14 Jun 2018 11:13:47 GMT

Hi Ben,

1) so when I'm running PAN OS 8.0.7, which USER ID agent version should I install? 8.0.7-2?

2) When I read it correctly, USER ID agent 8.0.7-2 is compatible with PAN OS 7.1.X. Is that correctly? Can I install USER ID agent 8.0.7-2 right now? (before upgrading my firewalls)

Re: want to upgrade to 8.0.X

Ben-W — Thu, 14 Jun 2018 11:34:58 GMT

Hi MPI-AE,

you can technically run the latest user-id agent as the are backwards compatible:

looks at 8.1 agent release notes: The User-ID agent is compatible with PAN-OS® 8.1 and earlier PAN-OS releases that Palo Alto Networks still support.

Agent: I would Deploy the latest within the given major release so either 8.0.9-6 or 8.1.1-77, while they may not be recommended they will include the latest fixes and protections. otherwise contact tac to obtain the current stable recommended release if any. apologies they used to publish the recommended versions but not sure if they still do as i could not locate for you.

You can either deploy the new agent on a new machince and add the agent to the firewall along side the old agent(s) which would give you the ability to check it is working as expected before removing old agents.. or go straight with upgrading the agent(s)

regards,

Ben

Re: want to upgrade to 8.0.X

MPI-AE — Fri, 15 Jun 2018 09:22:10 GMT

Thank you!