Upgrade PAN OS from 10.1 to 11.1

[H.Sutanto]

Hi Community,

My customer plan to upgrade their PAN OS from 10.1 to 11.1

From documentation said, You can now use the Skip Software Version Upgrade feature to skip software versions when upgrading your device from PAN-OS 10.1 or later releases.

What is skip software version upgrade?, How to use it? so that I can go direct upgrade to 11.1 without install 10.2 and 11.0 first, because when I click that link, error 404 Page Not Found

Sorry if my question is very basicly

Thank you.

Regards,

Heru

[emr_1 · Accepted solution]

Here is links you are looking for:

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features/management-features/skip-software-...
https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-release-notes/features-introduced-in-pan-os/man...

Your understanding is correct.

If you use legacy way to upgrade, you need to follow the steps as below: (describe this for comparison purpose)

1. download 10.2.0 (base image) and 10.2.x (latest) ** system is running on 10.1.x

2. install 10.2.x and reboot the system

3. download 11.0.0 (base image) and 11.0.x (latest)

4. install 11.0.x and reboot the system

5. download 11.1.0 (base image) and 11.1.x (latest)

6. install 11.1.x and reboot the system

With new feature, you can done by only two steps:

1. download 11.1.0 (base image) and 11.1.x (latest) ** system is running on 10.1.x

2. install 11.1.x and reboot the system

You don't need any technique or preparation (I mean commands) for it. Just download and install, then reboot.

[kiwi]

Hi @H.Sutanto ,

Source: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features/management-features/skip-software-...

In PAN-OS 11.0, you can now skip up to three software versions when upgrading or downgrading standalone devices or Panorama managed devices running PAN-OS 10.1 or a later release. This feature builds on the Simplified Software Upgrade process introduced in PAN-OS 10.2, which includes capabilities such as a multi-image download option and a pre-install validation check, to make the upgrade process even faster.

Kind regards,

-Kim.

[H.Sutanto]

Hi Kiwi,

Sorry, I still don't understand yet,

In PAN-OS 11.0, you can now skip up to three software versions when upgrading or downgrading standalone devices or Panorama managed devices running PAN-OS 10.1 or a later release. <===== What I understand, it support PAN-OS 10.1 or later to direct upgrade to 11.1

But in the second line, This feature builds on the Simplified Software Upgrade process introduced in PAN-OS 10.2, which includes capabilities such as a multi-image download option and a pre-install validation check, to make the upgrade process even faster.

this mean PAN-OS 10.1 doesn't have this feature.

Please correct me if I am wrong.

Thank you

[H.Sutanto]

Hi Emr_1,

Thank you for your reply,

I just knew that we can download base image (11.1.0) and latest image (11.1.x) then only install 11.1.x

What I read from documentation I need to install base image first then reboot, after that install latest image then reboot.

So, it can installation 11.1.0 can be skipped right? only install 11.1.x, as long as I have download both OS (base and latest)

Thank you

[emr_1 · Accepted solution]

Yes, you can skip installing 11.1.0 (base image).

I put sample CLI output for you.

Upgrading from 10.1.11-h5 to 11.1.2 directly.

admin@PA-VM> show system info | match sw-version
sw-version: 10.1.11-h5

admin@PA-VM> request system software info

Version               Size          Released on Downloaded
-------------------------------------------------------------------------
11.1.2               586MB  2024/02/25 22:54:18        yes
11.1.1               559MB  2023/12/26 10:10:40         no
11.1.0              1179MB  2023/11/02 12:02:59        yes
11.1.0-h2            439MB  2024/01/07 16:52:41         no
11.0.3               519MB  2023/11/06 10:01:53         no
11.0.3-h5            519MB  2024/02/22 12:13:02         no
11.0.3-h3            519MB  2024/01/15 05:40:41         no
11.0.2-h3            497MB  2024/01/10 12:21:40         no
11.0.2-h2            497MB  2023/09/21 12:00:27         no
11.0.2-h1            497MB  2023/08/16 14:25:42         no
11.0.2               497MB  2023/06/28 10:13:04         no
11.0.1               492MB  2023/03/29 15:05:25         no
11.0.1-h3            493MB  2024/01/06 14:50:22         no
11.0.1-h2            493MB  2023/05/30 13:11:06         no
11.0.0              1037MB  2022/11/17 04:45:28         no
11.0.0-h2            293MB  2023/12/28 09:47:33         no
11.0.0-h1            293MB  2023/11/06 17:10:24         no
10.2.8               642MB  2024/02/12 17:02:12         no
10.2.7-h3            591MB  2023/12/18 09:45:48         no
10.2.7               563MB  2023/11/09 07:06:33         no
10.2.6-h1            563MB  2024/01/04 11:28:40         no
10.2.6               563MB  2023/09/27 08:55:35         no
10.2.5               575MB  2023/08/17 08:41:56         no
10.2.4-h10           553MB  2024/01/02 17:08:48         no
10.2.4-h4            553MB  2023/07/27 11:01:55         no
10.2.4-h3            551MB  2023/07/05 09:58:19         no
10.2.4-h2            502MB  2023/05/16 12:19:44         no
10.2.4               582MB  2023/03/30 09:25:44         no
10.2.3-h12           569MB  2024/02/27 12:06:08         no
10.2.3-h11           566MB  2024/01/02 10:46:58         no
10.2.3-h9            566MB  2023/11/07 03:33:38         no
10.2.3-h4            566MB  2023/02/13 14:51:11         no
10.2.3-h2            565MB  2022/12/13 10:27:27         no
10.2.3               545MB  2022/09/29 11:26:49         no
10.2.2-h1           1010MB  2022/06/28 10:12:10         no
10.2.2               528MB  2022/06/07 10:21:50         no
10.2.2-h4            527MB  2024/01/04 07:59:36         no
10.2.2-h2            527MB  2022/08/18 09:06:37         no
10.2.1               522MB  2022/04/18 13:11:04         no
10.2.1-h1            522MB  2024/01/03 20:02:59         no
10.2.0              1010MB  2022/02/27 15:32:20         no
10.2.0-h2            303MB  2024/01/04 15:23:21         no
10.1.12              518MB  2024/01/25 03:54:51         no
10.1.11              490MB  2023/09/25 13:30:08         no
10.1.11-h5           517MB  2024/01/23 07:13:02        yes
10.1.11-h4           517MB  2023/12/14 08:48:16         no
10.1.11-h1           490MB  2023/11/02 01:39:57         no
10.1.10-h5           476MB  2023/12/29 20:12:21         no
10.1.10              471MB  2023/05/04 12:34:33         no
10.1.10-h2           476MB  2023/08/03 04:03:27         no
10.1.10-h1           475MB  2023/07/05 09:30:43         no
10.1.9-h8            471MB  2023/12/27 06:04:56         no
10.1.9-h3            471MB  2023/04/24 10:26:12         no
10.1.9               471MB  2023/02/05 15:26:57         no
10.1.9-h1            471MB  2023/03/07 08:57:13         no
10.1.8-h7            467MB  2023/12/26 09:38:40         no
10.1.8-h6            467MB  2023/11/10 11:08:03         no
10.1.8-h2            467MB  2022/12/19 13:12:16         no
10.1.8               461MB  2022/10/20 12:52:05         no
10.1.7-h1            467MB  2023/12/29 10:43:13         no
10.1.7               461MB  2022/09/12 14:40:59         no
10.1.6-h8            467MB  2023/12/26 08:27:07         no
10.1.6               459MB  2022/05/24 12:45:57         no
10.1.6-h7            467MB  2023/11/09 10:08:59         no
10.1.6-h6            459MB  2022/08/09 15:48:38         no
10.1.6-h3            459MB  2022/06/21 08:11:09         no
10.1.5               457MB  2022/03/24 17:15:57         no
10.1.5-h4            465MB  2023/12/26 07:08:46         no
10.1.5-h3            465MB  2023/11/13 13:16:08         no
10.1.5-h2            457MB  2022/04/25 10:59:44         no
10.1.5-h1            456MB  2022/04/06 22:37:17         no
10.1.4               406MB  2021/12/22 11:50:58         no
10.1.4-h6            415MB  2023/12/26 04:06:43         no
10.1.4-h4            407MB  2022/02/25 09:44:02         no
10.1.3-h3            413MB  2023/12/26 03:10:51         no
10.1.3-h2            412MB  2023/11/09 09:55:22         no
10.1.3               356MB  2021/10/26 18:51:53         no
10.1.2               353MB  2021/08/16 22:44:28         no
10.1.1               297MB  2021/07/21 09:33:46         no
10.1.0               917MB  2021/06/02 04:16:22        yes
..........snip..........

admin@PA-VM> debug swm status

Partition         State             Version
--------------------------------------------------------------------------------
sysroot0          RUNNING-ACTIVE    10.1.11-h5
sysroot1          REVERTABLE        None
maint             READY             10.1.11-h5

admin@PA-VM> request system software install version 11.1.2
Executing this command will install a new version of software. It will not take effect until system is restarted. Do you want to continue? (y or n)

Software install job enqueued with jobid 6. Run 'show jobs id 6' to monitor its status. Please reboot the device after the installation is done.
6

admin@PA-VM> show jobs id 6

Enqueued              Dequeued           ID                              Type                         Status Result Completed
------------------------------------------------------------------------------------------------------------------------------
2024/02/29 13:18:51   13:18:51            6                         SWInstall                            FIN     OK 13:23:05
Warnings:

Details:Software installation successfully completed. Please reboot to switch to the new version.




admin@PA-VM> debug swm status

Partition         State             Version
--------------------------------------------------------------------------------
sysroot0          RUNNING-ACTIVE    10.1.11-h5
sysroot1          PENDING-CHANGE    11.1.2
maint             READY             11.1.2

admin@PA-VM> request restart system


..........RESTARTING..........


admin@PA-VM> show jobs all

Enqueued              Dequeued           ID  PositionInQ                              Type                         Status Result Completed
------------------------------------------------------------------------------------------------------------------------------------------
2024/02/29 13:29:38   13:29:58            2                                        AutoCom                            FIN     OK 13:31:28

admin@PA-VM> show system info | match sw-version
sw-version: 11.1.2
admin@PA-VM> debug swm status

Partition         State             Version
--------------------------------------------------------------------------------
sysroot0          REVERTABLE        10.1.11-h5
sysroot1          RUNNING-ACTIVE    11.1.2
maint             READY             11.1.2

admin@PA-VM>

[H.Sutanto]

Thanks for your help Emr_1

[SergioCruzSirt]

Hello, If I can reuse this topic to ask a further question.

I have similar situation but we'll also migrate from a 3220 pair in HA to a 1420 pair in HA.

We are currently on 10.1.10-h2

The 1420 came out-of-the-box with 11.0.

I asume I can import configuration on them and update to 11.1.2?

[jsmoove]

Hello,

I don't see PAN-OS 11.0.4 anywhere mentioned. What is the date it was released?

TIA

[H.Sutanto]

Hi Jsmoove,

PAN-OS 11.0.4 has been released a week ago.

Have you click check now from your PAN?

[JimMcGrady]

What is "legacy way" compared with "new feature"?

[TKEInfrasec]

Hi ,

Is this process applicable to firewall on HA? or is it only for single firewalls with No HA.

Also can we can skip downgrades like this?

[H.Sutanto]

Hi,

yes, this process applicable on HA, I have done.

[emr_1]

I described to upgrade by each minor version like 9.1->10.0->10.1 as "legacy"

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan...

[emr_1]

The answer for both questions is yes.
I'll attach the evidence log that shows combination of 10.1.11-h4 and 11.1.2-h1 (keeps active and passive state) as below.

For downgrade, skip works between 11.1 and 10.1.3. For more details see url below.

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/downgrade-pan-os/downgra...

admin@PA-440-1(active)> show high-availability all

Group 10:
  Mode: Active-Passive
  Local Information:
    Version: 1
    Mode: Active-Passive
    State: active (last 19 minutes)
    Device Information:
      Model: PA-440
      Management IPv4 Address: 192.168.113.5/20
      Management IPv6 Address:
      Jumbo-Frames disabled; MTU 1500
    HA1 Control Links Joint Configuration:
      Link Monitor Interval: 3000 ms
      Encryption Enabled: no
    HA1 Control Link Information:
      IP Address: 192.168.113.5/20; Gateway: 192.168.127.254
      MAC Address: 8c:36:7a:00:f8:ec
      Interface: management
      Link State: Up; Setting: 1Gb/s-full
      Key Imported : no
    Election Option Information:
      Priority: 100
      Preemptive: no
      Promotion Hold Interval: 2000 ms
      Hello Message Interval: 8000 ms
      Heartbeat Ping Interval: 2000 ms
      Max # of Flaps: 3
      Preemption Hold Interval: 1 min
      Monitor Fail Hold Up Interval: 0 ms
      Addon Master Hold Up Interval: 500 ms
    Active-Passive Mode:
      Passive Link State: shutdown
      Monitor Fail Hold Down Interval: 1 min
    Version Information:
      Build Release: 10.1.11-h4
      URL Database: 20240520.20121
      Application Content: 8850-8748
      IOT Content: 128-502
      Anti-Virus: 4823-5341
      Threat Content: 8850-8748
      VPN Client Software: Not Installed
      Global Protect Client Software: 6.2.2
      Plugin Information:
        DLP: 1.0.8
    Version Compatibility:
      Software Version: Mismatch
      Application Content Compatibility: Match
      IOT Content Compatibility: Match
      Anti-Virus Compatibility: Match
      Threat Content Compatibility: Match
      VPN Client Software Compatibility: Match
      Global Protect Client Software Compatibility: Match
      Plugin Information:
        DLP: Compat Match
    State Synchronization: User-disabled
  Peer Information:
    Connection status: up
    Version: 1
    Mode: Active-Passive
    State: passive (last 37 seconds)
    Last suspended state reason: User requested
    Device Information:
      Model: PA-440
      Management IPv4 Address: 192.168.113.6/20
      Management IPv6 Address:
      Jumbo-Frames disabled; MTU 1500
    HA1 Control Link Information:
      IP Address: 192.168.113.6
      MAC Address: 8c:36:7a:00:f8:ce
      Connection up; Primary HA1 link
    Election Option Information:
      Priority: 101
      Preemptive: no
    Version Information:
      Build Release: 11.1.2-h1
      URL Database: 0000.00.00.000
      Application Content: 8850-8748
      IOT Content: 128-502
      Anti-Virus: 4823-5341
      Threat Content: 8850-8748
      VPN Client Software: Not Installed
      Global Protect Client Software: 6.2.2
      Plugin Information:
        DLP: 5.0.1
  Initial Monitor Hold inactive; Allow Network/Links to Settle:
    Link and path monitoring failures honored
  Link Monitoring Information:
    Enabled: yes
    Failure condition: any
    No link monitoring groups
  Path Monitoring Information:
    Enabled: yes
    Failure condition: any
    Virtual-Wire Groups:
      No Virtual-Wire path monitoring groups
    VLAN Groups:
      No VLAN path monitoring groups
    Virtual-Router Groups:
      No Virtual-Router path monitoring groups
  Configuration Synchronization:
    Enabled: yes
    Running Configuration: not synchronized
      Out-of-sync Reason: Version mismatch
admin@PA-440-1(active)>