Upgrade issues

[ldormond]

Hello,

I have a PA-500 device running on PanOS 3.1.4.  I try to update it to last release PanOS 4.0.2. (Direct upgrade allowed following the RN)

I have no Internet conection yet, also I would like to install it from a local file.

I click "Upload", locate my software package PanOS_500-4.0.2 then I click "Install from File" and select my package from the drop-down list, I get the error "Failed to install with the following error:
"The required '4.0' base image must be loaded before this image can be loaded. You do not have to install or
run the base image, only download it. Once the base is loaded, re-download your target image.
Failed to load /opt/pancfg/mgmt/sw-images/PanOS_500-4.0.2"

I try the same with PanOS_500-4.0.1 and I get :

"Failed to install with the following errors. /usr/local/bin/panswinstaller.sh: line 63:
[panos: command not found SW version is 4.0.1 Error: Upgrading from 3.1.4 to 4.0.1 requires a content version
of 217 or greater and found 171-548. Failed to install version 4.0.1 type panos"

Any idea ?

Thanks in advance

Laurent

[bpappas]

Upgrade your dynamic application/threat content to version 245 and then install 4.0.2.

The 4.0.2 software will install properly if the 4.0.1 images are manually loaded onto the firewall. You do not need to install 4.0.1 software image. It is necessary to upload it to the device in order for the 4.0.2 install to do some sanity checking prior to installation.

-Benjamin

[pieters]

Hi Benjamin,

I have a similar issue.

I'm trying to upgrade from 3.0 to 3.1 and get the error message "content version of 157 or greater and found 58-413".

I currently have 263-1105 installed which should be recent enough.

I have to remark that in addition to the error above, when I try to re-install the content (or upgrade to the latest which is 264-1111 as of writing) I get the error  "device: Threat database handler failed" followed by "commit failed".

rgs,

Luc

[nrice]

PAN-OS 3.0 was end-of-life as of 12/17/2010.  The latest supported content version on 3.0 is 240-936, though  devices may be able to load higher versions.  The threat db handler error you are receiving indicates that you have hit the limit.  The workaround is to downgrade to your last successful content load and upgrade to 3.1 as soon as possible to continuing using the dynamic updates.

[paloalto.netfos]

HI,

I have the same issue now.

I get the same error message "device: Threat database handler failed" when I upgrade firmware from 3.0 to 3.1.

But I cannot get the dynamic update version 240-936 in support website.

How can I find this version ? Include these two types : only app and app + threat

Sample

[nrice]

Please contact Support so that they can make the file available to you vila FTP.

[pieters]

just wanted to provide an update of how I got into trouble and what I did to solve it.

My mistake was to bring the content database up-to-date before upgrading the OS.

I thought that would be a good idea but it turned out it wasn't.

The result was that my database was more recent than what the OS I was upgrading to could handle (or expected).

So I got an error  "content version of 157 or greater and found 58-413".

To solve the issue I needed to downgrade the database. I was able to get the version I needed from here:

https://support.paloaltonetworks.com/index.php?option=com_pan&task=download_updates&ut=si&vn=240-936...

From there on the process is like others in this thread discribe. Download (but don't install) the base image for the major version you want to upgrade to (eg. for 4.0.x the first release was 4.0.1) and then download and install the latest version of that particular major release (4.0.5 at the time of writing).

After that, you can upgrade your content database(s) and you should end up with a fully updated functional system.

[ldormond]

Here is what I did in order to make it work :

Indeed, I recently had to upgrade some PA-2050.

First of all, in the PanOS 4.0.5 RN, it says, under Upgrade/Downgrade Procedures :

"In order to upgrade to PAN-OS 4.0, the device must be running PAN-OS 3.1.0 or
later."

This remark is false, since I actually was in 3.1.2, but I was getting the same message  :

"Failed to install with the following error:
The required '4.0' base image must be loaded before this image can be loaded."

Also you actually need to install PanOS 4.0.1 first and only this image, indeed, I tried with a 4.0.2 image at first but it ran into the same error.

After you upgraded the device to PanOS 4.0.1 and performed a reboot, then you can upgrade to last PanOS 4.0.x release.

Hope this helps.

Regards,

Laurent

[bpappas]

@Laurent:

You are not entirely correct.

You did not need to install the 4.0.1 image. You must have the 4.0.1 PAN-OS image downloaded to the device, at this point you can install any of the 4.0.X versions directly from any of the 3.1.X versions.

Hopefully this clears up any lingering confusion.

Thanks,

Benjamin