03-19-2018 09:46 PM
Hi Everyone,
i am currently running 7.1.14 and am looking to upgrade to 8.08 with third part trancivers
HPE X242 10G SFP+ to SFP+ 3m Direct Attach Copper Cable J9283B
I read in the Upgrade/Downgrade Considerations Support for Third-Party SFP Transceivers
that to not upgrade to 8.0 or 8.1 unless you then upgrade to a maintenance release that contains the fix for this issue.
also it states
Additionally, when you are ready to upgrade, make sure that you do not reboot the firewall after you download and install the PAN-OS 8.1 (or PAN-OS 8.0) base image until after you download and install a maintenance release that contains the fix for this issue.
My question is
How do i know if there is a maintenaince release ideally 8.06 that contains the fix?
and also is it possible to upgrade to 8.0 and the to 8.06 without restarting?
03-20-2018 10:21 AM
TAC won't be able to help here I'm afraid. If it's not the exact models sold by PAN, it may work but may not. Support will not check compatibility of transceivers that aren't sold by Palo Alto Networks. The official 3rd party policy is here:
https://www.paloaltonetworks.com/services/support/support-policies/third-party-components-support
As for the question regarding whether 8.0.6 contains the fix, it does not. You can always look at the release notes for any version to see fixes up-to and including that version. In this instance, the links at the bottom of the Upgrade/Downgrade block that @PaulBrock linked to show the transceiver issue mentioned as PAN-92564. That issue ID is a known issue in 8.1.0 and the latest version of 8.0 (8.0.8). Since it is in the "known issue" section it does not yet have a fix available. When a known issue is fixed, future release notes show what version contains that fix in both the Known Issues section and the Issues Resolved in this Release section.
Regarding the reboot question, the caveat listed is "Additionally, after we provide a release with this fix and you begin the upgrade process, you must not reboot the firewall after you download and install the PAN-OS 8.0 base image until after you download and install the maintenance release with this fix."
What that means is when you do decide to upgrade from 7.1 to 8.0, you just need to download the 8.0.1 base image but NOT reboot. Instead, download the version that contains the fix (whatever version that ends up being) immediately after downloading 8.0.1. Then reboot to the fixed version.
Hopefully this clarifies things a bit!
-Greg Wesson
03-20-2018 09:58 AM
You should probably open a TAC case to check on the compatability of the transcievers. I'm using a 3rd party transciever on 8.0.6 in production but I tested the brand in a lab before upgrading production.
You can't get to 8.0.6 without a reboot. Current best-practice to upgrade from 7.1.14 to 8.0.6 would be to install the latest 7.1 and reboot, take a snapshot for rollback, install 8.0 and reboot and then 8.0.8 and reboot.
03-20-2018 10:21 AM
TAC won't be able to help here I'm afraid. If it's not the exact models sold by PAN, it may work but may not. Support will not check compatibility of transceivers that aren't sold by Palo Alto Networks. The official 3rd party policy is here:
https://www.paloaltonetworks.com/services/support/support-policies/third-party-components-support
As for the question regarding whether 8.0.6 contains the fix, it does not. You can always look at the release notes for any version to see fixes up-to and including that version. In this instance, the links at the bottom of the Upgrade/Downgrade block that @PaulBrock linked to show the transceiver issue mentioned as PAN-92564. That issue ID is a known issue in 8.1.0 and the latest version of 8.0 (8.0.8). Since it is in the "known issue" section it does not yet have a fix available. When a known issue is fixed, future release notes show what version contains that fix in both the Known Issues section and the Issues Resolved in this Release section.
Regarding the reboot question, the caveat listed is "Additionally, after we provide a release with this fix and you begin the upgrade process, you must not reboot the firewall after you download and install the PAN-OS 8.0 base image until after you download and install the maintenance release with this fix."
What that means is when you do decide to upgrade from 7.1 to 8.0, you just need to download the 8.0.1 base image but NOT reboot. Instead, download the version that contains the fix (whatever version that ends up being) immediately after downloading 8.0.1. Then reboot to the fixed version.
Hopefully this clarifies things a bit!
-Greg Wesson
03-20-2018 01:57 PM - edited 03-20-2018 01:58 PM
Thankyou both for taking the time to respond in a very detailed manner, I have also opened a case with TAC and have just got back the following response
PAN-92564 .
It's not yet resolved in 8.0.8. Fix is planned for 8.0.9 release which is due for release by end of this month.
Fingers crossed .
I am curious what other people use in regards to 3rd party transceiver
My firewall connects into a HPE switch which only accepts HP branded trancivers using 10gb DAC, so therefore I was allways grateful PA is transceiver agnostic .
Paul
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
