Identifying Preferred/Recommended PAN-OS Versions

[Brandon_Wertz]

I recently upgraded 2 locations of 3420s and 3410s to 10.2.10h4 from 10.2.7h8 and it looks like Palo Alto has included a feature that will identify the "preferred" software versions.

This is a pretty neat feature native in the GUI which will help admins quickly identify the current preferred releases.

As always admins should do their due diligence in reviewing the release notes for any potential conflicts.

[Adrian_Jensen]

I dislike it... While the addition of another column the indicates the preferred releases is good, they simultaneously removed the viewing of all other release by default, including releases currently installed on the PA. You have to make multiple clicks just to view the available/installed software, and as soon as you navigate away and back you have to make multiple clicks all over again. It doesn't save your viewing selections like other pages.

[Brandon_Wertz]

---

@Adrian_Jensen wrote:

I dislike it... While the addition of another column the indicates the preferred releases is good, they simultaneously removed the viewing of all other release by default, including releases currently installed on the PA. You have to make multiple clicks just to view the available/installed software, and as soon as you navigate away and back you have to make multiple clicks all over again. It doesn't save your viewing selections like other pages.

---

Yeah...It actually freaked me out.  I had to make multiple clicks to find "all" available OS versions.  I initially thought there was a problem.

I also dislike that this was done in the middle of the code release.  That said I think that over-all this feature is more of a benefit than a negative.  Admins just need to get used to it.

[bhilgenkamp]

Is there a CLI command or API call I can make against the firewall to get the preferred version list?

[Adrian_Jensen]

I can't test if the updated OS versions show the preferred releases separately as I am still running a non-preferred-showing release. But I would guess it is an additional column of info for the following commands:

CLI:

user@firewall(active) >  request system software info

API:

https://firewall/api/?type=op&cmd=<request><system><software><info></info></software></system></request>

[emr_1 · Accepted solution]

Add "preferred" or "base" at end of CLI

sample output:

admin@FW1(active)> request system software info preferred

Version Size Released on Downloaded
---------------------------------------------------------------------------
11.2.7-h4 848MB 2025/10/30 11:11:53 no
11.1.10-h1 964MB 2025/06/30 13:14:36 no
11.0.4-h6 874MB 2024/11/17 05:01:15 yes
10.2.16-h4 1044MB 2025/09/25 04:27:33 no
10.1.14-h13 656MB 2025/04/04 07:34:54 no
9.1.18 528MB 2024/02/27 05:30:02 no
9.1.17 528MB 2023/12/11 04:34:58 no
8.1.26 797MB 2024/02/14 19:37:48 no

admin@FW1(active)> request system software info base

Version Size Released on Downloaded
---------------------------------------------------------------------------
11.2.0 1403MB 2024/05/02 10:15:58 yes
11.1.0 1417MB 2023/11/02 12:02:07 yes
11.0.0 1175MB 2022/11/16 20:45:47 yes
10.2.0 1180MB 2022/02/27 15:33:04 yes
10.1.0 1157MB 2021/06/02 04:18:46 yes
10.0.0 1148MB 2020/07/16 12:15:39 no
9.1.0 1013MB 2019/12/13 08:52:19 no
9.0.0 1375MB 2019/02/05 20:37:57 no
8.1.0 1253MB 2018/03/01 17:29:27 no
8.0.0 1095MB 2017/01/29 14:03:36 no

admin@FW1(active)>