Prepare for End-of-Life PAN-OS and Migrate to Latest PAN-OS Version

[nekumar]

How to prepare for PAN-OS end-of-life and migration.

 

IMPORTANT

PAN-OS 8.1 and 9.0 will end-of-life on March 1, 2022, and PAN-OS 10.0 will be end-of-life on July 16, 2022.  

To continue to receive uninterrupted technical support, timely bug fixes and maintenance releases, and support for content signatures, please migrate to a more recent PAN-OS version. Learn about upcoming end-of-life events on our End of Life Summary. For additional visibility into what can be expected during end of life events, please reference our end-of-life policies. 

Reach out to your Palo Alto Networks rep to kick-start migration conversations to move to the preferred release of PAN-OS 9.1 or PAN-OS 10.1. 

Find out what’s new in PAN-OS 9.1, PAN-OS 10.0, and PAN-OS 10.1. Update to new versions to take advantage of over 100+ security innovations that range from increasing security efficacy to simplifying management. 

FAQ

Q: What is Palo Alto Networks End-of-Life (EOL) support policy?  

Customers on End-of-Life (EOL) PAN-OS versions do not get technical support, content updates, bug fixes, maintenance releases, workarounds, and patches for critical bugs.

The support duration for our major releases (see definition below) is 24 months from the date of release, and all minor releases (see definition below) in a major release train will be supported for 42 months from the date of release. Refer to the “PAN-OS Version Support Policy” section here for more details. 

Q: What do these key terms mean?

• Major feature release: Where each release includes three numbers (x.y.z) : The “x” represents a major feature release, which usually includes a large number of new features and/or significant software architectural changes. Major releases have y = 0. 
• Minor feature release: The “y” in the x.y.z nomenclature above represents a minor feature release, which usually includes a small to medium number of new features and typically minimal software architecture changes. Minor releases have y > 0. 
• Maintenance release: The “z” in the x.y.z nomenclature above represents a maintenance release, which only includes bug fixes.
• Examples:

PAN-OS release  (where x is the major feature release)	Support Duration
x.0.0	Supported for 24 months.  All maintenance releases e.g., x.0.1 go end-of-life at the same time as x.0.0 release
x.1.0	Supported for 42 months.  All maintenance releases e.g., x.1.1 go end-of-life at the same time as x.1.0 release
x.2.0	Supported for 42 months All maintenance releases e.g., x.2.1 go end-of-life at the same time as x.2.0 release

Q: How is software support impacted if a PAN-OS release has reached the end of support, but an end of sale hardware platform must run the same PAN-OS release until it reaches its end of life? 

In this case, the software will continue to be supported for that specific hardware platform until the platform’s published end of life date. 

As an example, PAN-OS 8.1 will get updates as we would normally do for any mature release until the PA-5000 end of life. 

Additional Information:

PAN-OS 10.1.3 achieves Preferred status: PAN-OS 10.1.3 has officially received the preferred status for Firewalls and PAN-OS 10.1.3-h1 for Panorama.  

What's in it for you? With PAN-OS 10.1, you can:

• Simplify identity and authentication for adopting Zero Trust with Cloud Identity Engine
• Secure your SaaS and web application access, prevent new and emerging phishing and DNS attacks, and more 
• Plus,  you get 70+ new features introduced in PAN-OS 10.0 like prevention from unknown file and web-based threats with real-time protections with Machine Learning, comprehensive IoT security, data loss prevention, simplified decryption including TLS 1.3 support, that you can use on your Palo Alto Networks Next-Generation firewalls

Talk to your account rep or check out this page for more information. 

[KenVaBr]

Why is this URL: https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-... shielded away from me? Which sort of account do I need to just watch the preferred release? 

[kiwi]

Hi @KenVaBr ,

That's a customer resource.  You'll need to use a customer account to access it (one you also use to login into the support portal).

Cheers,

-Kiwi.

[KenVaBr]

Pity. Such basic information. Since i don't have an account myself as I just help some customers with PAN as an external consultant.

[santonic]

So we need do downgrade all the (brave) customers from 10.0 to 9.1 which hasn't been marked for end-of-life yet? And when 10.1 eventually becomes stable we have to upgrade via then unsupported version 10.0?  

[kiwi]

Hi @santonic ,

I see your point. 

That said, PAN-OS 10.0 is currently still supported and PAN-OS 10.1 currently has a stable/preferred release (10.1.4-h4).

Cheers,

-Kiwi.

[santonic]

I have one 10.1.4-h4 in production for a couple of months and I've encountered 2 bugs already so I can't agree it's stable. At the moment I am not recommending upgrade to 10.1 to any of our customers. And with 10.0 going EOL I guess they will have to stay on 9.1 for a while.

[PatrickPater]

@santonic I absolutely agree with you. Maintenance release v10.1.5-hf1 released early April. This does not give confidence yet. It also becomes difficult to schedule an upgrade just before a summer break.

To be clear for me, after July 16, 2022 there will be no longer content updates available for 10.0.x?

[Tulgabat]

which version needs to be installed on PA3050? currently, 9.0.9 installed

[vrnbhati]

Hello Expert,

Currently, I am using PANOS 9.0.7 and as you already know 9.0 is EOL.

So I need a Stable version for my PA-220, please suggest.😀

Thanks in advance!!!!

[santonic]

I would say the only stable version is 9.1. Version 10.0 is also quite OK but for some reason it's going EOL.

10.1. is still buggy as hell. I only have 3 in production and I've been experiencing crashes and bugs on 10.1.4 and 10.1.5-h1

[torryhenderson]

Has anyone had any experience with 10.2.x?