Panorama on 6.1.7, can it manage 6.0.7

[ldavie]

Hello all. Tomorrow night I will be upgrading our firewalls to 6.1.7, they (and Panorama) are currenlty on 6.0.7. Can I upgrade Panorama now and still manage the firewalls on 6.0.7 if I need to make any changes between today and tomorrow?

Thanks!

[pankaku]

PANOS of panorama should be higher or equal to the firewall.

[ldavie]

They sure do, but can panorama running 6.1.7 still manage a firewall on 6.0.7. Guess I will just upgrade it and find out.

[pankaku · Accepted solution]

Yes you can keep panorama to 6.1.7 and can manage firewall on 6.0.7

[ebonjour]

You do not have to just guess, if panorama is above the version of code on the firewalls it will be able to manage without any major issues.  One thing I noticed is that NTP server configuration is different on the 6.1 code version, so it will register that all devices are out of sync.  I was able to commit via panorama without issue to 6.0 devices despite the NTP discrepencies.

[ldavie]

Thanks to you both. I asked because a while back (I don't remmeber the combination of code that I was running Panorama on that was above the code the firewalls were on) I was not able to push a particular config change to the firewalls. Don't remember the details though.

[DC1233]

Possible that the configuration change was a feature not supported on the older version.  We manage a decent amount of devices with Panorama so inevitably we have firewalls on different versions until they can all be updated during change windows.  We have not seen any issues with backward compatability.