We just upgraded a couple PA-3020s from 8.1.20-h1 to 9.1.12 (we were advised by support not to go to the hotfix if we didn't have a problem). No problems with our IPSec tunnels after the upgrade.
Something that did bite us though.... 9.1 uses a new PAN-DB URL Filter provider and license, and the existing URL database is deleted on the upgrade. We use URL Filter block on "unknown" and "not-resolved" categories (default is allow). That meant that after the upgrade the PA could not download the new license or initial database... Had to find and change until the database was initialized.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!