Testing during Palo Alto 3000 cluster upgrade from 8.1.15-h3 to 9.1.11

[landoa]

Hello,

I would like to know if an upgrade that traverses multiple major versions requires testing after an upgrade to each major version?

Our upgrade path is:  8.1.15-h3 -> 8.1.20 -> 9.0 -> 9.0.14 -> 9.1 -> 9.1.11

Ideally, we would only upgrade one appliance in the cluster all the way to 9.1.11, though I know this is not recommended because appliances in a cluster should not be further than 1 major version apart.

So, the conservative path would be to break this into two stages: upgrade entire cluster to 9.0.14 and fully test?  Then proceed to 9.1.11?

Thanks for any advice!

[TomYoung]

Hi @landoa ,

I would upgrade the entire cluster to 9.0.14, then upgrade it again to 9.1.11.

I would not test for the interim version since it is only temporary.  I would implement the full test plan for 9.1.11.  The TAC recommended releases are very stable.

https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-...

Thanks,

Tom

[OtakarKlier]

Hello,

While testing never hurts, I have yet to have an upgrade break existing things.

Regards,

[landoa]

Thanks for this feedback.

I've done a few upgrades in the past and also never encountered problems.

However, when planning major changes, its always good to have a rollback option.  If we do the upgrade in two steps (testing after each major release), I like that we can easily, and quickly, failover to the other cluster member on the old software version.

In case of problems, we have the option to rollback software, but this requires more downtime and is more intensive than a simple failover.  

So, I need to decide if we want to take a bit more time with the two-step approach, or run the risk, albeit minimal, that we have to rollback.

Thanks again for your two cents!

[virat18]

I wouldn't test for the interim version as it's only temporary. I would follow the full test strategy for 9.1.11. The TAC suggested releases are extremely stable. See Palo Alto Networks exams. I'm 100% agree with you, you should need to see following paloaltonetworks link to more clear.

live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304