PA - 3020 recommended version and how to upgrade from PAN - OS from 8.0.4

[ChiragP]

Hi All,

I would like to know what's a recommended version for PA - 3020? 

The current running version is 8.0.4.

Suppose, I want to install 8.1.8 released OS, do I need to follow below path?

Go to device software -> download and Install OS version 8.1.0 -> Restart to install new version 8.1.0

Go to device software -> download and install OS version 8.1.8 -> Restart to install new version 8.1.8

please advise, whether I can go directly from PAN-OS 8.0.4 to 8.1.8 or I have to follow the method which I mentioned above. 

Thank you for your support. 

Regards,

CP

[BatD · Accepted solution]

@ChiragP You need to download 8.1.0 and ideally install it, before installing 8.1.x. You do not need to reboot after installing 8.1.0. 

Also make sure that you install the latest content updates before the installation. 

Also not that 8.1.8 has some issues and the current preffered realase is 8.1.9-h4. 

So really you process should be: 

• Download and Install the latest dynamic content version (Apps or Apps+Threat if you have the license)
• Download and install 8.1.0
• Download and install 8.1.9-h4 
• Reboot

[ChiragP]

Hi, 

Thanks for the reply, appreciated. 

I have looked at this post https://live.paloaltonetworks.com/t5/General-Topics/Recommended-PAN-OS-version/m-p/252664#M71799.

It says PAN-OS 8.1.6 is preferred for PA - 3020, which one should I go for 8.1.6 or 8.1.9-h4? Please advise if you can. 

Thank you. 

[ChiragP]

I have a spare PA 200 device which is running with OS version 8.0.6. I downloaded OS 8.1.6 and tried to install on it. 

I have received below error from the command line:

"The required '8.1.0' base image must be loaded before this image can be loaded. You do not have to install or run the base image, only download it. Once the base is loaded, re-download your target image."

So, following the above description given by the device, I believe for PA 3020 applies the same - download the base version 8.1.0 but NOT INSTALL! Download the 8.1.9-h4 version and install. 

Any suggestions!!

Thank you.  

[BatD]

@ChiragP The post you are looking for is from July. The current recommended version is 8.1.9-h4. It has also have fixes for major vulnerability in previous versions. 

You are right that it will work without installing 8.1.0, however the new best practice guidence is to install it first to avoid errors. The reason beeing is that both images will need to be extracted when installing and installation can fail on smaller appliences with limited disk space. 

[ChiragP]

Hi BatLD,

Thank you for the clarification. I was thinking too to install the 8.1.0 to make it easier instead of just download.

I will go with OS 8.1.9-h4 and see the behaviour. I will provide an update soon about how I go with it. 

Thank you. 

Regards,

CP

[ChiragP]

Hi BatD,

Regards to dynamic content update, is there any limitation to run on OS?

Example: current Apps + Threats latest version requires minimum 7.1.0 OS version. Can current Apps+Threats version installed on 6.1.0 version? OR it has to be minimum supported version specify in release notes.  

[BatD]

I think in theory there should not be, and the advise is always to upgrade to the lates content version. However in my experience, the new 4digit content failed to install on older PanOS, which are now out of support (e.g. 5.0. or 6.0.). It only worked when installing older content, however there is no official option to download older content versions. 

I think that 6.1.0 should be fine, because it went out of support after the 4 digit content release. Just make sure that you first install the latest 6.1.x bugfix. If you are stuck, you can open a support ticket and ask for older content version. 

[ChiragP]

Hi BatD,

Thanks for the quick respose, appreciated!