PANos version on Panorama vs the PANos version on a firewall

[Lance]

Good Day,

I would like to know if I am running PANos 7.0.11 on a Palo Alto firewall what version software should Panorama be running?

[kiwi · Accepted solution]

Hi @Lance,

Some examples to clarify :

Panorama 7.0 can manage Firewall PANOS 6.0.3+ or 6.1 or 7.0

Panorama 7.1can manage Firewall PANOS 6.1.3+ or 7.0 or 7.1

Panorama can manage firewalls running PAN-OS versions that match the Panorama version or are earlier than the Panorama version. The exception is that Panorama 6.1 and later versions cannot push configurations to firewalls running PAN-OS 6.0.0 through 6.0.3. Panorama cannot manage firewalls that run a later PAN-OS version than the Panorama version. For example, Panorama 6.0 cannot manage firewalls running PAN-OS 7.0. For versions within the same feature release, although Panorama can manage firewalls running a later version of PAN-OS, we recommend that Panorama run the same version or a later version. For example, if Panorama runs 7.0.3, it is recommended that all managed firewalls run PAN-OS 7.0.3 or earlier versions.

Full details here :

https://www.paloaltonetworks.com/documentation/71/panorama/panorama_adminguide/panorama-overview/pla...

Cheers !

-Kim.

[BrianRa · Accepted solution]

Lance,

We managed 7.0.X PAN OS for a while with Panorama 7.1.X without major problems.  There are some feature changes between the two so our Panorama pushes did not always equate to the same thing on the firewalls.

In the future we will be keeping Panorama on the same major revision as the firewalls with the exception of testing a major release before we push it to the production firewalls.

You will want to run the same minor release or newer on Panorama.

Brian

[bbilut · Accepted solution]

Same here... currently I have 7.1.8 on my Panorama and my four firewalls have 7.0.14. No issues.