topic Re: VMWare ESXi PAN-OS upgrade: from 8.0.7 to 8.1.3 ->Active/Passive HA (without Panorama) in General Topics

VMWare ESXi PAN-OS upgrade: from 8.0.7 to 8.1.3 ->Active/Passive HA (without Panorama)

ash83 — Fri, 24 Aug 2018 09:54:35 GMT

Hi community,

Having reviewed:

https://www.paloaltonetworks.com/documentation/81/pan-os/newfeaturesguide/upgrade-to-pan-os-81/upgrade-the-firewall-to-pan-os-81/determine-pan-os-upgrade-path#id181QEN0D0QY

and

https://www.paloaltonetworks.com/documentation/81/pan-os/newfeaturesguide/upgrade-to-pan-os-81/upgrade-the-firewall-to-pan-os-81/upgrade-an-ha-firewall-pair-to-pan-os-81#idab14f5f2-f662-4e5c-ba5b-2cc35993e2ec

Is this the right upgrade path to be followed?

8.0.7 to 8.0.12

8.0.12 to 8.1.1

8.1.1 to 8.1.3

or (skipping 8.0.12 to 8.1.1-> unsure whether or not this is required)

8.0.7 to 8.0.12

8.0.12 to 8.1.3

And lastly, what is a feature realease? :"When you upgrade from one PAN-OS feature release version to a later feature release, you cannot skip the installation of any feature release versions in the path to your target release."

Thanks.

Re: VMWare ESXi PAN-OS upgrade: from 8.0.7 to 8.1.3 ->Active/Passive HA (without Panorama)

BPry — Fri, 24 Aug 2018 13:51:58 GMT

@ash83,

So you would actually use the following upgrade path.

8.0.7 -> Whatever the latest maintenance release is for 8.0.x

8.0.x -> 8.1.0 (base)

8.1.0 -> 8.1.3

Palo Alto no longer recommends jumping directly to the target maintenance release within the next major version due to having to explode both images to build the installer. This takes up a lot of disk space and makes it more likely that a bit here or a bit there will get out of place.

So whenever you install a major software update you'll want to upgrade to whatever the latest maintenance release is; then upgrade to the base of the next major software release, and then finally update to the target maintenance release in that version.

A feature release is a major software version; so 7.0, 7.1, 8.0, 8.1 are all feature releases. 8.1.1 for example would be a maintenance release. What that note is saying is essentially; if you're running 7.0 and you want to upgrade to 8.1, you can't skip 7.1 and 8.0 to get there.

Re: VMWare ESXi PAN-OS upgrade: from 8.0.7 to 8.1.3 ->Active/Passive HA (without Panorama)

ce1028 — Sun, 26 Aug 2018 01:45:29 GMT

Interesting and great into.

Prior you could go this route.

8.0.7 -> whatever the latest maintenance release is for 8.0.x

8.1.0 (base) - download only but not install

8.1.x - install

This was always hit or miss, I guess that's why they changed it

Re: VMWare ESXi PAN-OS upgrade: from 8.0.7 to 8.1.3 ->Active/Passive HA (without Panorama)

BPry — Sun, 26 Aug 2018 02:10:46 GMT

@ce1028,

That was an old recommendation, and one that Palo Alto has since moved away from. The issue with that install method is that both the 8.1.0 and the 8.1.* maintenance release that you're actually installing need to be exploded onto the disk, and then a functional install image is built with bits and pieces from both images. This takes drastically more disk space then a simple install in the current recommendation and causes a better chance that something will go wrong.

* Just as a side note, most people that had an issue with simply downloading the base image and then installing the maintenance release were using the smaller platforms (PA-200, PA-3000, ect). However it really comes down to available diskspace, to be safe they simply changed the recommendation for everyone. I would still highly recommend you follow the new recommendation.

Re: VMWare ESXi PAN-OS upgrade: from 8.0.7 to 8.1.3 ->Active/Passive HA (without Panorama)

ce1028 — Sun, 26 Aug 2018 02:26:29 GMT

@BPry Indeed! I've been following the procedure you posted for some time now. No issues at all. Yes, I run a lot of 200s,3000s

Re: VMWare ESXi PAN-OS upgrade: from 8.0.7 to 8.1.3 ->Active/Passive HA (without Panorama)

ash83 — Tue, 04 Sep 2018 13:00:01 GMT

Thanks BPry, excellent assistance.