Upgrade Clarification from Documentation

[Scott127]

I found a post on the forum that went inactive about a month ago stating if you are upgrading from 8.1. to 9.1 you should

1. Download 9.0.0

2. Install the Preferred 9.0.X release

3. Download 9.1.0

4. Install the Preferred 9.1.X release

The documentation below states on Page 9 "For manual upgrades, you must install the base image for a feature release before you upload and install a maintenance release image."

 https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/pan-os/9-1/pan-os-new-features/pan-... 

This page below suggests from 8.1.x 

1. Download and install the latest preferred PAN-OS 8.1 maintenance release and reboot.

2. Download PAN-OS 9.0.0
3. Download and install the latest preferred PAN-OS 9.0 maintenance release and reboot.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/upgrade-to-pan-os-91/upgrade-the-fi... 

Is 9.0.0 and 9.1.0 not a base image for a feature release?

[Adrian_Jensen]

Yes, 9.0.0 and 9.1.0 are both base releases. The "Determine the Upgrade Path to PAN-OS 9.1" tells you to do stepped upgrades from your current release to the latest 9.0.x version before moving to step 4:

Proceed to Upgrade the Firewall to PAN-OS 9.1.

Then from the 9.1 upgrade doc you follow the links depending on whether you are upgrading a stand alone or HA pair firewall. Same procedure as a 8.x and 9.0, download and install the 9.1.0 base image, then download and install the 9.1.x maintenance release. (Note that the 9.1 upgrade docs tell you to download 9.1.0 [step 5.2 for standalone/step 6.2 for HA] but incorrectly show a picture of installing the 9.0.0 base image [step 5.3/6.3]): 

• Upgrade a Standalone Firewall to PAN-OS 9.1
• Upgrade an HA Firewall Pair to PAN-OS 9.1

[Scott127]

Just to be clear. This document shows only downloading 9.0.0 from 8.1.x as seen in Step 2 below.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/upgrade-to-pan-os-91/upgrade-the-fi... 

This page below suggests from 8.1.x 

1. Download and install the latest preferred PAN-OS 8.1 maintenance release and reboot.

2. Download PAN-OS 9.0.0
3. Download and install the latest preferred PAN-OS 9.0 maintenance release and reboot.

[Adrian_Jensen]

Yes, the Determine the Upgrade Path to PAN-OS 9.1 page just shows the path to get to the latest 9.0.x release, before doing the 9.1 upgrade. I believe PaloAlto wants you to do this as the 9.1.0 base package is assumed to be updating an existing 9.0.x configuration file to 9.1.x format and earlier PAN-OS release configurations might have different options that do not translate correctly to 9.1. After installing the latest 9.0 maintenance release you proceed to Upgrade the Firewall to Pan-OS 9.1