Upgrade from version 10.2.7-h8 to 10.2.11-h2

[F.Basco]

Hi, could you help me?
I should make a release change from version 10.2.7-h8 to 10.2.11-h2
for palo alto 3440. The two firewalls are in HA
Can you tell me the various release jumps I should do and if there is a procedure to follow?

[Raido_Rattameister]

I would install 10.2.11-h2 on passive, reboot passive.

After passive comes back online and is healthy then install and reboot active one.

No need to install intermediate versions.

When active goes for reboot then active role will be automatically handed over to other firewall.

But what made you choose specifically 10.2.11-h2 version? TAC suggestion?

[F.Basco]

Thanks for your immediate and precise response...
I chose this release because it allows me to circumvent (second high pole) CVE vulnerabilities.
I take advantage of your kindness, do you also have a link or Procedure/document that I could follow during the upgrade?

[Raido_Rattameister · Accepted solution]

Today TAC preferred version is 10.2.10-h7

https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-...

Official upgrade guide can be found at https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan...

Also look into 10.2.12-h2 as according to https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan... it mitigates recent management port vulnerability.