topic Re: PAN-OS recommendation in General Topics

PAN-OS recommendation

karthikeyanB — Fri, 19 Apr 2019 07:12:11 GMT

Dear All,

Currently PA 5200 is running with PA-OS-8.0.13 and we are facing issues with the number of objects that we could create.

Release notes of 9.0 provides a promising object count increase. Kindly provide a stable version of 9.0 and PoA to upgrade from 8.0 to the recommended version.

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/management-features/mgmt-object-capacity-increase#

Thanks in advance

Re: PAN-OS recommendation

Remo — Fri, 19 Apr 2019 09:44:26 GMT

Hi @karthikeyanB

So far PAN-OS 9 is still to new to have a recommended version by PaloAlto TAC. In march 2019 the recommended releases are: 8.1.6 , 8.0.15 and 7.1.22.

Do you need all the address objects or could it be that a lot of them are unused?

Re: PAN-OS recommendation

BPry — Fri, 19 Apr 2019 15:10:25 GMT

@karthikeyanB wrote:

Release notes of 9.0 provides a promising object count increase. Kindly provide a stable version of 9.0 and PoA to upgrade from 8.0 to the recommended version.

Plane and simple, there isn't one. If it is determined that you can't lower the object count on your device, and that you really need to utilize objects in your policies, then you would need to review the known issues with PAN-OS 9.0, and those specific to 9.0.1, HERE and determine if the business risk of utilizing the new release is worth the object count increase. I would hazard a guess that you wouldn't want to increase potential for downtime just to get an object count increase, but that's a business decision that your organization needs to make.

Re: PAN-OS recommendation

ethiSEC — Sat, 20 Apr 2019 10:28:28 GMT

PAN used to offer advice on Recommended releases, recently this changed to Preferred releases.

9.0.1 has a P* status which means it's a preferred release with additional notes. I'd suggest you ask the TAC for guidance on this as there may be some issues that will cause problems, but it looks like it may be a viable release for you early on its life.

Sometimes you may need to upgrade to a newer, less stable release if you require features. You may need to live with some minor issues though if you do upgrade.

Jason