topic Upgrade issues in General Topics

Upgrade issues

ldormond — Tue, 10 May 2011 13:43:40 GMT

Hello,

I have a PA-500 device running on PanOS 3.1.4. I try to update it to last release PanOS 4.0.2. (Direct upgrade allowed following the RN)

I have no Internet conection yet, also I would like to install it from a local file.

I click "Upload", locate my software package PanOS_500-4.0.2 then I click "Install from File" and select my package from the drop-down list, I get the error "Failed to install with the following error:
"The required '4.0' base image must be loaded before this image can be loaded. You do not have to install or
run the base image, only download it. Once the base is loaded, re-download your target image.
Failed to load /opt/pancfg/mgmt/sw-images/PanOS_500-4.0.2"

I try the same with PanOS_500-4.0.1 and I get :

"Failed to install with the following errors. /usr/local/bin/panswinstaller.sh: line 63:
[panos: command not found SW version is 4.0.1 Error: Upgrading from 3.1.4 to 4.0.1 requires a content version
of 217 or greater and found 171-548. Failed to install version 4.0.1 type panos"

Any idea ?

Thanks in advance

Laurent

Re: Upgrade issues

bpappas — Tue, 10 May 2011 14:05:27 GMT

Upgrade your dynamic application/threat content to version 245 and then install 4.0.2.

The 4.0.2 software will install properly if the 4.0.1 images are manually loaded onto the firewall. You do not need to install 4.0.1 software image. It is necessary to upload it to the device in order for the 4.0.2 install to do some sanity checking prior to installation.

-Benjamin

Re: Upgrade issues

pieters — Wed, 07 Sep 2011 08:52:32 GMT

Hi Benjamin,

I have a similar issue.

I'm trying to upgrade from 3.0 to 3.1 and get the error message "content version of 157 or greater and found 58-413".

I currently have 263-1105 installed which should be recent enough.

I have to remark that in addition to the error above, when I try to re-install the content (or upgrade to the latest which is 264-1111 as of writing) I get the error "device: Threat database handler failed" followed by "commit failed".

rgs,

Luc

Re: Upgrade issues

nrice — Thu, 08 Sep 2011 15:42:45 GMT

PAN-OS 3.0 was end-of-life as of 12/17/2010. The latest supported content version on 3.0 is 240-936, though devices may be able to load higher versions. The threat db handler error you are receiving indicates that you have hit the limit. The workaround is to downgrade to your last successful content load and upgrade to 3.1 as soon as possible to continuing using the dynamic updates.

Re: Upgrade issues

paloalto.netfos — Tue, 04 Oct 2011 09:41:14 GMT

HI,

I have the same issue now.

I get the same error message "device: Threat database handler failed" when I upgrade firmware from 3.0 to 3.1.

But I cannot get the dynamic update version 240-936 in support website.

How can I find this version ? Include these two types : only app and app + threat

Sample

Re: Upgrade issues

nrice — Tue, 04 Oct 2011 15:41:49 GMT

Please contact Support so that they can make the file available to you vila FTP.

Re: Upgrade issues

pieters — Wed, 05 Oct 2011 07:49:21 GMT

just wanted to provide an update of how I got into trouble and what I did to solve it.

My mistake was to bring the content database up-to-date before upgrading the OS.

I thought that would be a good idea but it turned out it wasn't.

The result was that my database was more recent than what the OS I was upgrading to could handle (or expected).

So I got an error "content version of 157 or greater and found 58-413".

To solve the issue I needed to downgrade the database. I was able to get the version I needed from here:

https://support.paloaltonetworks.com/index.php?option=com_pan&task=download_updates&ut=si&vn=240-936&ct=contents&prod=3.1&plat

From there on the process is like others in this thread discribe. Download (but don't install) the base image for the major version you want to upgrade to (eg. for 4.0.x the first release was 4.0.1) and then download and install the latest version of that particular major release (4.0.5 at the time of writing).

After that, you can upgrade your content database(s) and you should end up with a fully updated functional system.

Re: Upgrade issues

ldormond — Thu, 06 Oct 2011 07:01:49 GMT

Here is what I did in order to make it work :

Indeed, I recently had to upgrade some PA-2050.

First of all, in the PanOS 4.0.5 RN, it says, under Upgrade/Downgrade Procedures :

"In order to upgrade to PAN-OS 4.0, the device must be running PAN-OS 3.1.0 or
later."

This remark is false, since I actually was in 3.1.2, but I was getting the same message :

"Failed to install with the following error:
The required '4.0' base image must be loaded before this image can be loaded."

Also you actually need to install PanOS 4.0.1 first and only this image, indeed, I tried with a 4.0.2 image at first but it ran into the same error.

After you upgraded the device to PanOS 4.0.1 and performed a reboot, then you can upgrade to last PanOS 4.0.x release.

Hope this helps.

Regards,

Laurent

Re: Upgrade issues

bpappas — Thu, 06 Oct 2011 19:55:18 GMT

@Laurent:

You are not entirely correct.

You did not need to install the 4.0.1 image. You must have the 4.0.1 PAN-OS image downloaded to the device, at this point you can install any of the 4.0.X versions directly from any of the 3.1.X versions.

Hopefully this clears up any lingering confusion.

Thanks,

Benjamin