topic Re: TAC Recommended PAN-OS Release 9.0 in General Topics

TAC Recommended PAN-OS Release 9.0

shehan — Fri, 01 Nov 2019 03:19:29 GMT

Hi Guys,

We are running 8.1.6 on our PA Gateway and Panorama and would like to upgrade it to 9.x.x. I went through the Release Guidance and it says the preferred released version is 9.0.4

https://live.paloaltonetworks.com/t5/Customer-Resources/Support-PAN-OS-Software-Release-Guidance/ta-p/258304

1. Is the version 9.0.4 is the generally recommended one?

2. According to the TAC best practice is to upgrade the panorama to a higher version than the gateway therefore what should be the gateway version and the panaroma version accordingly?

TIA

Re: TAC Recommended PAN-OS Release 9.0

VincentPresogna — Fri, 01 Nov 2019 16:11:10 GMT

I have my PA-820 running 9.0.4 since it was release. Haven't had any issues, and it even resolved an issue I was having with LDAP group mappings.

Re: TAC Recommended PAN-OS Release 9.0

BruceBennett — Fri, 01 Nov 2019 17:52:31 GMT

Hi Shehan,

The link you provided actually answers your first question, 9.0.4 is the preferred OS for firewalls and Panorama.

As for having Panorama one version higher, my understanding is that Panorama must be at the same level or higher to manage the firewalls. The key being "at the same level". I know I try to keep Panorama up to the preferred version listed, but I cannot do the same with my firewalls, as it is a challenge to plan the changes that often.

The important thing is that you are safe running the same OS version on Panorama as you are on the firewalls.

Re: TAC Recommended PAN-OS Release 9.0

OtakarKlier — Fri, 01 Nov 2019 22:08:53 GMT

Hello,

Check the release notes and make sure you're not affected by any of the known issues. I have 9.0.4 running on many different models and all is well.

Regards,

Re: TAC Recommended PAN-OS Release 9.0

Remo — Sun, 03 Nov 2019 19:18:23 GMT

Hi @shehan

9.0.4 is the preferred release from the 9.0 major version. As far as I know not the generally recommended one*
Gw and panorama can be on the same version but gw shouldn't be higher. (This at least is required when you open a TAC case. In practice it normally also works when gw is on a higher version than panorama - as long as they are on the same major version)

*This is only my personal recommendation and nothing official, but because of too many problems in the past I will always wait until x.x.8 or even x.x.9 version until I upgrade to a new majorversion.

Re: TAC Recommended PAN-OS Release 9.0

Brandon_Wertz — Mon, 04 Nov 2019 19:45:35 GMT

@Remo wrote:
*This is only my personal recommendation and nothing official, but because of too many problems in the past I will always wait until x.x.8 or even x.x.9 version until I upgrade to a new majorversion.

Agreed. I deployed a 5220 running 8.0.5...Thought it was a stable code, ended up crashing both the A/P box because a netflow bug. The bug wasn't fixed until 8.0.8.

So for a major enterprise I'd wait until at least .7+ of a patch level on a new major release.