Upgrade path to 8.1.6 from 8.0.14

Reply
Highlighted
L1 Bithead

Upgrade path to 8.1.6 from 8.0.14

Hello can you advise on the recommended upgrade path from PAN-OS 8.0.14 to 8.1.6 ?

 

can i install directly the 8.1.6 version or do i have to install first 8.0.15 ?

 

so it is  8.0.14 -> 8.0.15 -> 8.1.6 ?

OR

8.0.14 -> 8.1.6 ?

OR

8.0.14 -> 8.0.15 -> 8.1.0 -> 8.1.6 ?

 

 

thanks in advance

L5 Sessionator

Re: Upgrade path to 8.1.6 from 8.0.14

Hey @stoikosr

 

All paths are "technically" viable but the most efficient is 8.0.14 -> 8.1.6 . However, 8.1.0 base version must be downloaded (doesn't have to be installed)

 

Cheers,

Luke.

 

L1 Bithead

Re: Upgrade path to 8.1.6 from 8.0.14

hey @LukeBullimore

 

efficient in terms of not wasting too much time on upgrading between versions i assume ?

 

i wonder just if there is a problem if you skip the versions in between , but  you say we just have to download the 8.1.0 base version but not install , may i ask why ??

 

 

thanks!

L5 Sessionator

Re: Upgrade path to 8.1.6 from 8.0.14

Hey @stoikosr

 

"efficient in terms of not wasting too much time on upgrading between versions i assume ?" - Correct. 

 

"i wonder just if there is a problem if you skip the versions in between" - Nope :) In some cases, skipping versions is actually preferred. For example, there is a bug in 8.1.0 where, if installed, may cause third party transceivers to stop working (fixed in 8.1.1 and later)

 

You don't need to install 8.1.0 when you're installing 8.1.4 for example because the 8.1.4 image will reference the 8.1.0 content downloaded on disk. If you tried to install 8.1.4 without 8.1.0 downloaded first it will fail. 

 

Cheers,

Luke.

L7 Applicator

Re: Upgrade path to 8.1.6 from 8.0.14

Hi @stoikosr

 

Since 8.0 the official recommendation is no longer to skip the base release (the bug here with the third party tranceivers here is another story).

But the recommended upgrade path as per paloalto documentation from 8.0.14 to 8.1.4 is:

8.0.14 --> 8.0.16 --> 8.1.0 --> 8.1.6

In other words: first upgrade to the latest maintenance release, then go to the base version of the next major version and finally install the maintenance release you want to go to.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRrCAK

 

As @LukeBullimore writes, you don't really need to install the base image, but this is no longer the recommended way to upgrade.

 

Regards,

Remo

 

PS: keep in mind, that 8.1.x also isn't recommended so far. So if you don't need to because of ine of the new features, then wait ;)

 

L1 Bithead

Re: Upgrade path to 8.1.6 from 8.0.14

hello @vsys_remo

 

so i am bit confused now , should we upgrade  from 8.0.14 --> 8.0.16 --> 8.1.0 --> 8.1.6

 

or skip all these versions and just do the upgrade

 

from 8.0.14 -> 8.1.4 , while downloading the 8.1.0 os also ?

 

Btw Why 8.1.x is not recommended ?

 

thanks very much for your replies !

L7 Applicator

Re: Upgrade path to 8.1.6 from 8.0.14

Hi @stoikosr

 

I understand your confusion. Prior to 8.0 the recommendation always was to only download the base and install the minor version directly. Then this was changed because this process required a lot of hdd space which lead to problems on smaller firewalls but the recommendation changed for all devices.

So back to your situation, I can only say how I would do it. If you are using third party tranceivers in your firewall, then skip the installation of the base version. Without tranceivers or with ones from paloalto I would do every step as recommended.

 


@stoikosr wrote:

Btw Why 8.1.x is not recommended ?


Paloalto gives only recommendations when you ask support. There is no public information about that available. The recommendation is (as far as I know) done when the case count is reduced or when there are no longer (critical) problems which could lead to more support cases. My experience since 4.0 is, it is better to wait until at least untill x.x.7, specially when you are using a lot of features. On firewalls that only do the basic functionality (application firewall without anything else) I also upgrade earlier, but with the ones with a lot of features enabled I had too much problems in the past when I installed new versions too early. But this everyone has to decide by him/herself and the best anyway is to have lab equipment where you can test new releases if they will work for you and your environment.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!