Upgrade PAN-OS from 9.1.14 to 10.1.10

[StevePayne]

hi, thanks for looking

we need to update our Box,  going to 10.1.10 from 9.1.14  does anyone see any issues?  is there a preferred route

if we did then go to 10.1.10  do I need a specific Global protect client version to work with it,  (currently on 5.2.10)

thanks

[kiwi · Accepted solution]

Hi @StevePayne ,

Please check the following for choosing the correct upgrade path:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan...

GP 5.2.x is still good although the preferred release is version 5.2.13:

https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-...

Kind regards,

-Kim.

[StevePayne]

thanks for the quick reply, 

few upgrades to get to 10.1.10, that's ok, I have a plan now

[dharmesh.purohit2020]

9.1.14 to 10.0.0 to 10.1.10-h1 we can go for upgrade path

 NOTE : they are saying there is no outage during upgrade but some VPN tunnels or regular traffic affects to sensitive applications. 

IPSEc tunnel Phase-1 not coming up normally. You have to clear tunnel and test again to bring up. 

[StevePayne]

So i upgraded  to 10.1.10-h2, and we have 4 gateways

2 built in 2017/2018 and 2 built Mar 2020,

the 2 earlier ones upgraded ok , but OCSP checking failed,  we rolld back a few times,  10.0.8  is what we currently using, as ocsp works

now we have the trouble of finding a  version where ocsp work's