Downgrade Firewall from 10.0.0 to 9.1.1

[RovshanRajabli]

Greeting Team!

I noticed some problems with a downgrade in my internal lab. So, some information: I want to downgrade from 10.1.7 to 9.1.1 (i need it for the experiment).

1st step i downgrade from 10.1.7 to 10.0.0, everything fine. But, when I want to downgrade from 10.0.0 to 9.1.1 I faced an error with: Upstream NAT not supported on 9.1.1, please delete it. (i can show it if needed).

I check the information about that, I find some. Like workaround advice to 1st have 10.0.3 or 10.0.4 PAN-OS, then delete upstream NAT from each interface. I try it, but, nothing, cli logs I can show too if needed.

Does somebody face that problem?

Thank you and have a good day!

#downgrade #wm #10.0.0 #9.1.1 #Up-StreamNAT NGFW 

[reaper]

if you're doing this for an experiment on 9.1, you could factory reset your device so you don't have to battle artefacts

[RovshanRajabli]

Dear Reaper, thank you for your response.

I need that experiment, cause soon I will do a downgrade on my working firewall. I can`t factory reset my firewall.

Best Regards.

[OtakarKlier]

Hello,

Is there a reason you need to downgrade? Is there a bug you are facing? Also which model of Palo Alto are you attempting this on?

Regards,

[RovshanRajabli]

Hi Dear Otakar,

Is there a reason you need to downgrade? - I need to be sure, that workaround works, and then apply it on the working firewall

Is there a bug you are facing? - I don't know actually, maybe its a bug, but I can't find information about it.

Also which model of Palo Alto are you attempting this on? - I go WM-50

[OtakarKlier]

Hello,

So if the VM is currently running 9.1.x and then you upgrade to 10.1.7, you should be able to downgrade back.

Regards,

[RovshanRajabli]

Dear OtakarKlier,

CM currectly running 10.1.x, as i write, i got no trouble with downgrade from 10.1.x to 10.0.x, but from 10.0.x to 9.1.x i faced problem.

Best Regards.

[OtakarKlier]

What was the code version the VM was initially deployed on?

[RovshanRajabli]

The Code version was 10.1.7 on my VM

[OtakarKlier]

If it was deployed at 10.1.7, why downgrade to 9.x.x? I would not recommend downgrading a device, physical or virtual to below what it was initially deployed on, so the lowest in this case would be 10.1.0.