Upgrade Palo Alto version

[soporteseguridad]

Hi,

I have 2 problems:

1) I refresh the Software in my Palo Alto and i cant see the new versions 5.x. The last version that i can dowload is 4.1.11. Why i can refresh the new releases????? I attached a screenshot with the error and the succesfull connecting to staticupdates.paloaltonetworks.com

2) I want to do an upgrade in this firewall from version 4.0.11 (Actual) to 5.0.2 . Do i need to download or install (previously) another image base or intermediate version?? or directly i can install the version 5.02 since 4.0.11??? There is any bug in the 5.0.2 version???

Thanks

[mikand]

1) Since you can get the list of up2date versions for 4.1 it should mean that your license is still valid. However I see a cert error in your screenshot and that you are using 4.0.11 which is from april 2012.

During autumn 2012 PA changed the update url if im not mistaken - I guess this is included if you download and install a newer release. For example install 4.1.0 and then install 4.1.11 - and then refresh the software downloads page.

Another way is to click on software downloads at https://support.paloaltonetworks.com and manually download the files needed and then manually upload them to your PA device to perform the update.

2) I have a slight memory that you need to first install the x.x.0 version and then install whatever version you prefer after that. For example if you want to go from 4.0.11 to 5.0.2 you should first install 5.0.0, reboot and then install 5.0.2.

If I remember correctly 5.0.2 has an issue on high mgmtplane usage on some models which seems to be addressed in 5.0.3 (or if it was the QoS bug - I dont remember).

So unless you really need to update today I think it might be healthy to wait for 5.0.3 to arrive (but then there will be other bugs so its an neverending story :smileysilly:).

There is also a doc somewhere here with a list of bugs which will be addressed in next version(s)... will return when I have located this doc.

Edit: I think this is the list I was thinking of

Regarding updateurl:

[soporteseguridad]

"2) I have a slight memory that you need to first install the x.x.0 version and then install whatever version you prefer after that. For example if you want to go from 4.0.11 to 5.0.2 you should first install 5.0.0, reboot and then install 5.0.2.2

Its necessary to install the version 5.0.0 or its enough download and no install. ??????

thanks so much....

[SCoupland]

If your device is in support, you can download the 5.0.0 image and then download and install any version of 5.0.x. If you aren't in support and are manually uploading and installing the images you will need to install 5.0.0 first before uploading and installing 5.0.x.

[mharding · Accepted solution]

From the release notes of 5.0.x: In order to upgrade to PAN-OS 5.0.0, the device must be running PAN-OS 4.1 or later. Attempts to upgrade to PAN-OS 5.0.0 from earlier releases will be blocked.

4.0.11 to 5.0.x is a mighty big jump.I would recommend upgrading the 4.1.x first, work out any bugs in your config/setup, and then go to 5.0.x.

[ExclusiveNetworksGermany]

Last answer is correct.

Update from 4.0 to 5.0 is not allowed. This is the reason why 5.0 is not displayed.

You have to go through 4.1.

Download 4.1.0 & 4.1.11

You can directly upgrade to 4.1.11.

After installing 4.1.11 you can refresh the Software List and 5.0.x will be visible.

Cheers

Marco

[ericgearhart]

+1 on going to 4.1.11 first... let the "dust settle" from that upgrade for at least a week before you make the leap er I mean jump to 5.0