topic Re: Recommended Pan-OS version in General Topics

Recommended Pan-OS version

dkordyban — Thu, 17 Jun 2021 10:23:28 GMT

I have a 5220 that I am using as core L3 segmentation router for my 500 user environment. Currently running 9.1.3 Pan-OS and What version of PAN-OS is recommended for this scenario. Is it generally advised to install the latest version posted on device-software check?

Re: Recommended Pan-OS version

S.Cantwell — Thu, 17 Jun 2021 14:18:36 GMT

The link to the recommended TAC release is

https://live.paloaltonetworks.com/t5/blogs/discussion-feature-recommended-pan-os-versions/ba-p/312299

You can always keep closer to the later version; so if you are running 9.1.3, you can comfortably be at 9.1.8 or 1.9.

Depending on newly added feature requirements, upgrading to the 10.0 or the 10.1 is something that you can do.

Re: Recommended Pan-OS version

Remo — Fri, 18 Jun 2021 23:28:45 GMT

As @S.Cantwell already wrote for recommended versions check the article about release guidance. The direct link is this one: https://live.paloaltonetworks.com/t5/Customer-Resources/Support-PAN-OS-Software-Release-Guidance/ta-p/258304

Just some little things I need to add:

If you use tls decryption with certificate revocation checking, make sure you upgrade to PAN-OS 9.1.10 and not 9.1.8/9 as there is a bug with this feature that could crash the decryption process
If you do not really, really need any of the new features of PAN-OS 10.1, then do not upgrade. This release is new and might(/probably) contains bugs that you do not want to have on a production firewall. Wait until there is a minor release that will be marked as a preferred one.

Re: Recommended Pan-OS version

dkordyban — Sat, 19 Jun 2021 10:47:25 GMT

Thank you. Makes sense to not upgrade to 10.1. What are your thoughts on upgrading to 10.0.6?

Re: Recommended Pan-OS version

Remo — Sun, 20 Jun 2021 19:17:52 GMT

Hi @dkordyban

(The following is not an official answer from paloalto, this is only my opinion based on a few years of experience with pan-os)

I recommend to stay with PAN-OS 9.1 until 10.0.8 is available. This is simply a general recommendation by me because in the past every time when I updated prior to x.y.8 we had ugly issues. These issues weren't always critical and also not always on all hardware, but I wait at least until x.y.8 until I upgrade to the new majorversion.