Panorama Major PAN-OS Upgrade - Full Commit and Push Requirement

[nohash4u]

Greetings All, 

Seeking clarification on the full commit and push of Panorama configuration required after upgrading to a major version (ex: 10.2.x to 11.1.x) outlined in step 13 of Upgrade Panorama with an Internet Connection. 

Is this actually required? This requirement is not outlined in the following LIVECommunity articles / KB articles regarding when a full push is required: 

• LIVEcommunity - Demystifying Selective Push on Panorama - LIVEcommunity - 1231335
• Under what circumstances is a full push from Panorama required? - Knowledge Base - Palo Alto Network...

Panorama 

[kiwi]

Hi @nohash4u ,

Yes, the requirement is indeed mandatory.

Major PAN-OS releases frequently introduce structural configuration changes, new object attributes, and underlying schema updates (for instance, PAN-OS 11.0/11.1 introduced overhauled shared object management for multi-vsys firewalls). A Full Push ensures Panorama properly translates and aligns the entire candidate configuration tree across all target software versions.

You need to do a Full Push first so Panorama can reset its baseline. If you jump straight to a Selective Push after upgrading, Panorama won't know how to compare the old and new versions, which leads to push errors.

Kind regards,