PanOS upgrade strategy

[Kandarp_Desai]

Hi All,

We are running PA firewalls + Panorama + Prisma Access in our environment. Our aim is to upgrade our cloud prisma plugin to 3.0 for additional features, however we are not getting the best approach to do this. 

Our existing environment is : 

Device	Current version	Expected Version
Bunch of firewalls in HA pairs	9.1.8	10.1.4-h4
Panorama	9.1.13	10.1.4-h4
Cloud Services Plugin	2.1.0-h12.preferred	3.0 preferred
Dataplane version	10.0.3	-
VM-series Plugin	2.0.4	-

How should one approach this ?

(1) Upgrade the Panorama + Plugins gradually ( 9 ---> 10.0 --->10.1 etc ) keeping the firewalls as is and then once Panorama + Plugins are upgraded we target the firewalls. 

(2) Upgrade the Panorama + Plugins + Firewalls all at once 

(3) Any other options ( we can have 0 downtime )

[Mudhireddy · Accepted solution]

Hi Kandarp,

I recommend going with the first option instead of all at once.

Important notes before upgrading:

•If using Panorama management in an HA configuration, HA must be set up before setting up Prisma Access management.

•Every Prisma Access cloud services plugin has a specific range of supported Panorama versions it is rated to work with.  Ensure that Panorama and the cloud services plugin are at compatible versions each time the plugin is installed or updated.