PAN OS Upgrade recomendation on latest 10.2.11 released 8/13/24 Currently Monitoring

[PCI_Network]

Hi all,

The PAN OS we used now is in 10.2.8. I have information from the link: https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-...

and it said that the latest release 10.2.11 release on 13 Aug 2024 currently under monitoring (believ it is not "preferred" version yet). 

May I know is it this information still true and how to counter verify this? Any body can advise is this latest version suitable to be used for patching now? 

Thanks and hope to hear from you soon.

Regards,

Tangsuan

[kiwi]

Hi @PCI_Network ,

Currently 10.2.9-h1 is the preferred version in the 10.2.x train.

As you say, 10.2.11 is NOT yet a preferred version but you are free to use it in case you need any of the fixes mentioned in the release notes:

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-release-notes/pan-os-10-2-11-known-and-addresse...

I recommend subscribing to the PAN-OS Software Release Guidance Page so that you will be updated whenever there's an update (eg. new preferred release).

Kind regards,

-Kim.

[PCI_Network]

Hi Kim,

Thanks to your reply.

May I know the path of patch from 10.2.8 to 10.2.11 or higher? Can the 10.2.8 directly patch to 10.2.11 or higher version?

Thanks and regards,

Tangsuan

[RH747]

Tangsuan,

Please refer to this document for more official details on upgrading PAN-OS: Support FAQ: Upgrading PAN-OS and Upgrade Paths | Palo Alto Networks

From my experience it's typically best to step up from your current release to the next base feature release and then to the preferred maintenance version of that base release. I've been told you can even skip installing the base feature version and so long as you have it downloaded that's all you need. I've tried both ways and haven't run into any issues, but I prefer the safe route of installing each step.

Simple example:

• 10.1.11-h5 (current) > 10.2.0 (base feature version) > 10.2.9-h1 (preferred release)

In your case you are on the same base feature version as the desired maintenance release so you can update directly to 10.2.11.

However, I strongly urge you to consider the preferred release instead, unless you need a newer release for a fix to your environment. From personal experience jumping to a new release before it has been marked as preferred can cause you a massive headache. Read the patch notes thoroughly before updating to a new PAN-OS release and use caution. Refer to the linked document for more on why you want to consider this carefully.

Regards,

RH747