Upgrade path from 9.1.x to 10.1

[HarryNoStyles]

Hello,

I need some help verifying that the below upgrade process from 9.1.x to 10.1.x is correct way.

1. Upgrade to the latest 9.1.x release

2. Download/install 10.0.0 base

3. Upgrade to the latest 10.0.0 relase

4. Download/install 10.1.0 base

5. Upgrade to the preferred 10.1.x release

Thank you!

[TomYoung · Accepted solution]

Hi @HarryNoStyles ,

That's pretty close.  Here are the modified steps:

1. Upgrade to the preferred 9.1 release.
2. Download 10.0 base.  No install needed.
3. Download/install preferred10.0 release.
4. Download 10.1 base.  No install needed.
5. Download/install preferred10.1 release.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan...

The link to the TAC preferred versions can be found in the URL above.

As always, install the latest dynamic updates and review the Upgrade/Downgrade Considerations (link also in URL above) before upgrading.

Thanks,

Tom

[HarryNoStyles]

Thank you!!

[Manu_P]

Hello, i'm finding myself in the same boat - i have to upgrade from 9.1.x. to 10.1.x (running a standalone HA active/passive PA-3220 pair)

The thing that bugs me, albeit rather slightly is the fact that 10.0.12 is listed the preferred 10.0 release, yet my firewalls latest downloadable option is 10.0.11-h1 dated 2022/08/17.

Any possible issues? Should i go 9.1.16 > 10.0.0 + 10.0.11-h1 > 10.1.0 + 10.1.10? (not like i have any other option currently, not even the customer support is listing 10.0.12, so i cannot manually download that version)

[kiwi]

Hi @HarryNoStyles ,

If you're missing PAN-OS 10.0.12 then your proposed path would be the way to go yes. I don't see any issues in doing that.

FYI, I am seeing PAN-OS 10.0.12-h1 in the support portal (tested for 5200 and 3200 platforms):

Kind regards,

-Kim.

[Manu_P]

Thanks for reply, but that's not what i'm seeing in my Customer Portal

[Karl]

Hello,

It seems not to have anymore a preferred release for the 10.0 version. Should we consider using the last release version (10.0.11-h1) ?

Another point that questions me. The preferred version of the 9.1 release is 9.1.16 (released on 2023/04/05). The last release of 10.0 version ( 10.0.11-h1) was published on 2022/08/17. There is no problem to upgrade the Firewall with an "older" version of PAN-OS ?

Regards,

Karl

[Manu_P]

Nope, no issues.

We went 9.1.16 > 10.0.11-h1 > 10.1.10 (preferred version at the time) with no issues

The process was something like this (we have a pair in ha active/passive and i did saved and exported the config from each node prior to each upgrade):

Secondary (passive): Download 10.0.0

Secondary (passive): Download 10.0.11-h1

Secondary (passive): Install 10.0.11-h1, reboot

Secondary running 10.0.11-h1, made active after reboot

Primary (passive): Download 10.0.0

Primary (passive): Download 10.0.11-h1

Primary (passive): Install 10.0.11-h1, reboot

Primary (passive): Download 10.1.0

Primary (passive): Download 10.1.10

Primary (passive): Install 10.1.10, reboot

Primary running 10.1.10, made active after reboot

Secondary (passive): Download 10.1.0

Secondary (passive): Download 10.1.10

Secondary (passive): Install 10.1.10, reboot

Everything went smooth, but it did take quite some time

[ZacRagoonath]

Good day, My first PA upgrade - coming from a Cisco background.
I'm unclear on the requirement to download the base for eg 10.0 but only isntall the preferred say 10.4 release.

If I'm on the latest 9.x release, should I not download AND install the 10.0 version ?

[Doug_Kershner]

 I've seen this discussed in other threads but no one gets specific enough

 And that is the relationship between Panorama OS and the firewalls associated with it. People say same version or less, others say you can use higher OS's as long as they are 10.1.x (for instance 10.1.9)

 So if Panorama is running 10.1.5.h-2 can you run the PA-220s on 10.1.9 or should I stick with 10.1.5.h-2? Best practice?

[Manu_P]

Hi there, 

you need to download the base version (no install), then download & install the preferred maintenance version

during the upgrade process you cannot skip any version, see the opening post or my own example (this was eased out in 11.0 which allows to skip versions )

If you are on latest 9.x release you just need to follow the steps in the opening post.

If you are running an HA setup with 2 nodes, you need to follow the steps i provided in a post above