topic Re: PA-220 - 9.1.6 - DO NOT UPDATE in General Topics

PA-220 - 9.1.6 - DO NOT UPDATE

LukeRath — Mon, 25 Jan 2021 18:15:28 GMT

Hi guys,

We have had 3 PA-220's recently that have all failed and needed to be factory reset when upgrading to 9.1.6. I have a case open to investigate further but this version is still the recommended version which is worrying.

Luke

Re: PA-220 - 9.1.6 - DO NOT UPDATE

Mick_Ball — Tue, 26 Jan 2021 17:27:52 GMT

@LukeRath

wow... nightmare...

we have 18 3020's recently upgraded from 9.0.9 and all are OK so not sure what the difference is with yours.

just downloaded both 9.10 and 9.1.6 and then installed 9.1.6.

we have a mixture of SA and HA all managed by panorama and most are GP gateways but all went well.

I know that doesn't really help you but must be something else going on here... what version were they on when you upgraded?

Re: PA-220 - 9.1.6 - DO NOT UPDATE

LukeRath — Tue, 26 Jan 2021 18:46:53 GMT

We were running 9.0.8 so it was a fairly big jump. Some of the 220's have updated fine so it might be something to do with the disk space or configs.

Re: PA-220 - 9.1.6 - DO NOT UPDATE

BPry — Tue, 26 Jan 2021 21:10:55 GMT

@LukeRath,

What was your actual upgrade procedure and what version were you upgrading from? All of my PA-220s upgraded to 9.1.6 perfectly fine, but they were also all running 9.1.5.

Re: PA-220 - 9.1.6 - DO NOT UPDATE

Sec101 — Thu, 28 Jan 2021 20:53:03 GMT

Very thankful for this post. Are most actually running 9.1 in production environments now - or is 9.0 the norm?

Re: PA-220 - 9.1.6 - DO NOT UPDATE

Brandon_Wertz — Fri, 29 Jan 2021 21:47:59 GMT

@Sec101 wrote:

Very thankful for this post. Are most actually running 9.1 in production environments now - or is 9.0 the norm?

We've got some 5250s, 5220s, 3220s, 3020s and 220s. I haven't put 9.1.X on the 3020s or 220s yet, but 9.1.X is on the others. We ran into a NAT oversubscription issue on the 3220s, but other than that the code seems stable. (docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/networking/nat/dynamic-ip-and-port-nat-oversubscription.html)

Re: PA-220 - 9.1.6 - DO NOT UPDATE

MP18 — Sat, 30 Jan 2021 08:10:09 GMT

@Sec101

I have few PA 220 and I did upgrade from 9.1.5 to 9.1.6 and they are working fine.

Regards

Re: PA-220 - 9.1.6 - DO NOT UPDATE

Richards265 — Tue, 02 Feb 2021 04:06:11 GMT

to redesign your PA-220, PA-820, and VM-300 firewalls to PAN-OS 9.0.0, download.

FaceTime for Windows

Re: PA-220 - 9.1.6 - DO NOT UPDATE

LukeRath — Mon, 01 Feb 2021 10:21:14 GMT

9.1 has been fine for us so far. The GP logs are a great feature too.

We have found the issue was with the previous version, not 9.1.6.

PAN-148676

Fixed an issue where the panlogs directory reached 100% utilization on the firewall due to early calculation of the .size file.

This bug fills the panlogs and causes the fw to fail during the upgrade. We have only noticed it with the PA-220 due to the smaller storage availability.