topic jumping from 8.0.17 to 8.1.7 directly? in General Topics

jumping from 8.0.17 to 8.1.7 directly?

chuckles — Mon, 08 Jul 2019 06:58:58 GMT

can i upgrade from 8.0.17 to 8.1.7 directly? also would going to 8.1.7 change any of my current config?

Re: jumping from 8.0.17 to 8.1.7 directly?

BatD — Mon, 08 Jul 2019 08:44:48 GMT

@chuckles Yes, you can. As long as you have 8.1.0 downloaded, you can install the 8.1.7 and it will need only one reboot.

The configuration update is normally designed to be compatible with your current configuraiton as much as possible. Based on experience, I have never had any issues with upgrades from 8.0.x to 8.1.x, but as normal, you should always review the release notes and upgrade procedure before planning the task.

Re: jumping from 8.0.17 to 8.1.7 directly?

khsieh — Mon, 08 Jul 2019 19:43:30 GMT

I made the jump without issue. Just be sure to have 8.1.0 downloaded as well.

Re: jumping from 8.0.17 to 8.1.7 directly?

BPry — Tue, 09 Jul 2019 14:29:37 GMT

@chuckles,

I would follow the recommended upgrade path just to ensure that you don't run into any issues at all. The issue with not installing 8.1.0 (usually on smaller/older hardware) is that the firewall needs to explode both the base image and the target maintenance release to build a working install image. That isn't a difficult task, but as the software images have gotten larger this process takes up more disk and some of the older hardware and smaller hardware simply can't free up enough disk space to build a functional image.

1) Download and install the latest maintenance relase.

2) Download and install the base image.

3) Download and install the target maintenance release.

It's likely that simply have the base image downloaded and letting the two images build a functional install image would be fine as long as you've verified that you actually have enough disk space for the firewall/panorama to actually perform that process. I would still recommend following the current recommendation to ensure that your upgrade process goes smoothly, especially when the OP fails to mention the model they are upgrading.

Re: jumping from 8.0.17 to 8.1.7 directly?

khsieh — Wed, 10 Jul 2019 20:54:20 GMT

I would NOT install 8.1. There are many bugs in 8.1 that don't get resolved until later versions. I have seen bugs listed that specifically say that it can cause problems on upgrade. I would download 8.1, but then download and install 8.1.8-h5, which is the current recommended version.

Re: jumping from 8.0.17 to 8.1.7 directly?

BPry — Wed, 10 Jul 2019 21:26:50 GMT

@khsieh,

You don't run with 8.1 installed and actually running your firewall for any length of time, you immediately perform the upgrade to your target maintenance release.

I'll state it again, but you can follow the old upgrade model where you only needed to download the base image if you want IT IS NOT BEST PRACTICE to do so. If the upgrade breaks your device because your disk ran out of space building a complete install image, tough nuggets.

The recommended upgrade path for migrating to 8.1 is the following:

1) Download and install 8.0.19 (as it's the latest maintenance relase).

2) Reload

3) Download 8.1.0 and 8.1.7 (remove any other image you may have installed except for 8.0.19)

4) Install 8.1.0 (you do not need to reload)

5) Install 8.1.7

6) Reload

7) Verify the device is functioning as intended.

Re: jumping from 8.0.17 to 8.1.7 directly?

MP18 — Sun, 21 Jul 2019 15:12:10 GMT

I will follow your path.

As i am upgrading all PA to 8.1.9 from 8.0.15.

Is it recommended to install 8.1.9?

Re: jumping from 8.0.17 to 8.1.7 directly?

BPry — Mon, 22 Jul 2019 01:20:59 GMT

@MP18,

Technically at this point in time 8.1.9 is not a recommended release. That being said, I haven't run into any new issues with 8.1.9 that weren't present in 8.1.8. I'm in the process of upgrading all of my managed firewalls to 8.1.9 and haven't run into any issues effecting production traffic.

Re: jumping from 8.0.17 to 8.1.7 directly?

jeremy.larsen — Tue, 23 Jul 2019 17:53:18 GMT

Current TAC recommended is 8.1.8 - https://live.paloaltonetworks.com/t5/Customer-Resources/Support-PAN-OS-Software-Release-Guidance/ta-p/258304

Re: jumping from 8.0.17 to 8.1.7 directly?

Pzilla — Tue, 23 Jul 2019 19:32:12 GMT

If you have a 5200 series HA pair and are thinking of running 8.1.7 or 8.1.8, be aware of the bugs discussed in this thread:

https://live.paloaltonetworks.com/t5/General-Topics/Bug-8-1-7-8-1-8-PA-5200-AUX-Ports/td-p/262440