Upgrade PAN500 from 7.0.2 to 8.0

[R_Sharma]

HI All

I am wanting to upgrade the PAN 500 currently on 7.0.2 to 8.0

Is there a good read what major release version I have to follow to do the step upgrade?

What major release i have to follow if anyone can guide me.

Regards

[BPry · Accepted solution]

@R_Sharma

You'd be looking at the following upgrade path. 

7.0.2 > 7.0.19

7.0.19 > 7.1.0

7.1.0 > 7.1.18

7.1.18 > 8.0.0

8.0.0 > 8.0.10 

I don't believe that 8.0.11-h1 is recommended yet, so I would stick to 8.0.10. 

[reaper · Accepted solution]

hi all

here's a link to the upgrade best practices guide: 

https://live.paloaltonetworks.com/t5/Featured-Articles/Best-Practices-for-PAN-OS-Upgrade/ta-p/111045

It is indeed recommended to go to the latest maintenance version in a train before moving on to the next major release as @BPry mentions

This takes a little longer but will help prevent running into issues

8.0.10 is currently recommended in the 8.0 code train, but you'll want to consider upgrading to 8.1 in a short while as 8.0 will go EOL by end of january 2019

[R_Sharma]

@BPry @reaper

Can I have your input please.

Can I upgrade one firewall in HA pair through below releases

7.0.2 > 7.0.19

7.0.19 > 7.1.0

7.1.0 > 7.1.17

or have to upgrade both firewall to each release before moving to next release.

That is- can I upgrade active firewall from 7.0.2> 7.0.19> 7.10 > 7.1.17 and then move to secondary Firewall? Or have to upgrade primary from 7.0.2 to 7.0.19 and then secondary from 7.0.2 to 7.0.19 and then again move to primary for next release.

Regards,

[BPry]

Since your just doing one major version I would say that your method would work perfectly fine and you won’t run into any issues.

[R_Sharma]

Sorry i am not clear. Which method?
Regards

[reaper]

---

@R_Sharma wrote:

@BPry @reaper

Can I have your input please.

Can I upgrade one firewall in HA pair through below releases

7.0.2 > 7.0.19

7.0.19 > 7.1.0

7.1.0 > 7.1.17

---

This method.

You do not _have_ to upgrade both members at the same time or even staggered. It's perfectly ok to move one member from 7.0.2 all the way up to 7.1.17 before you start working on the second member.