Upgrade path from 9.1.x to 10.1

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Upgrade path from 9.1.x to 10.1

L0 Member

Hello,

I need some help verifying that the below upgrade process from 9.1.x to 10.1.x is correct way.

 

1. Upgrade to the latest 9.1.x release

2. Download/install 10.0.0 base

3. Upgrade to the latest 10.0.0 relase

4. Download/install 10.1.0 base

5. Upgrade to the preferred 10.1.x release

 

Thank you!

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hi @HarryNoStyles ,

 

That's pretty close.  Here are the modified steps:

 

  1. Upgrade to the preferred 9.1 release.
  2. Download 10.0 base.  No install needed.
  3. Download/install preferred10.0 release.
  4. Download 10.1 base.  No install needed.
  5. Download/install preferred10.1 release.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan...

 

The link to the TAC preferred versions can be found in the URL above.

 

As always, install the latest dynamic updates and review the Upgrade/Downgrade Considerations (link also in URL above) before upgrading.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

View solution in original post

10 REPLIES 10

Cyber Elite
Cyber Elite

Hi @HarryNoStyles ,

 

That's pretty close.  Here are the modified steps:

 

  1. Upgrade to the preferred 9.1 release.
  2. Download 10.0 base.  No install needed.
  3. Download/install preferred10.0 release.
  4. Download 10.1 base.  No install needed.
  5. Download/install preferred10.1 release.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan...

 

The link to the TAC preferred versions can be found in the URL above.

 

As always, install the latest dynamic updates and review the Upgrade/Downgrade Considerations (link also in URL above) before upgrading.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

Thank you!!

Hello, i'm finding myself in the same boat - i have to upgrade from 9.1.x. to 10.1.x (running a standalone HA active/passive PA-3220 pair)

The thing that bugs me, albeit rather slightly is the fact that 10.0.12 is listed the preferred 10.0 release, yet my firewalls latest downloadable option is 10.0.11-h1 dated 2022/08/17.

Any possible issues? Should i go 9.1.16 > 10.0.0 + 10.0.11-h1 > 10.1.0 + 10.1.10? (not like i have any other option currently, not even the customer support is listing 10.0.12, so i cannot manually download that version)

 

Community Team Member

Hi @HarryNoStyles ,

 

If you're missing PAN-OS 10.0.12 then your proposed path would be the way to go yes. I don't see any issues in doing that.

 

FYI, I am seeing PAN-OS 10.0.12-h1 in the support portal (tested for 5200 and 3200 platforms):

 

kiwi_0-1689246155795.png

 

Kind regards,

-Kim.

LIVEcommunity team member, CISSP
Cheers,
Kiwi
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Thanks for reply, but that's not what i'm seeing in my Customer Portal

 

Manu_P_0-1689249638341.png

 

Hello,

It seems not to have anymore a preferred release for the 10.0 version. Should we consider using the last release version (10.0.11-h1) ?

Another point that questions me. The preferred version of the 9.1 release is 9.1.16 (released on 2023/04/05). The last release of 10.0 version ( 10.0.11-h1) was published on 2022/08/17. There is no problem to upgrade the Firewall with an "older" version of PAN-OS ?

 

Regards,

Karl

Nope, no issues.

We went 9.1.16 > 10.0.11-h1 > 10.1.10 (preferred version at the time) with no issues

 

The process was something like this (we have a pair in ha active/passive and i did saved and exported the config from each node prior to each upgrade):

Secondary (passive): Download 10.0.0

Secondary (passive): Download 10.0.11-h1

Secondary (passive): Install 10.0.11-h1, reboot

Secondary running 10.0.11-h1, made active after reboot

Primary (passive): Download 10.0.0

Primary (passive): Download 10.0.11-h1

Primary (passive): Install 10.0.11-h1, reboot

Primary (passive): Download 10.1.0

Primary (passive): Download 10.1.10

Primary (passive): Install 10.1.10, reboot

Primary running 10.1.10, made active after reboot

Secondary (passive): Download 10.1.0

Secondary (passive): Download 10.1.10

Secondary (passive): Install 10.1.10, reboot

 

Everything went smooth, but it did take quite some time

L0 Member

Good day, My first PA upgrade - coming from a Cisco background.
I'm unclear on the requirement to download the base for eg 10.0 but only isntall the preferred say 10.4 release.

If I'm on the latest 9.x release, should I not download AND install the 10.0 version ?

 

 I've seen this discussed in other threads but no one gets specific enough

 And that is the relationship between Panorama OS and the firewalls associated with it. People say same version or less, others say you can use higher OS's as long as they are 10.1.x (for instance 10.1.9)

 

 So if Panorama is running 10.1.5.h-2 can you run the PA-220s on 10.1.9 or should I stick with 10.1.5.h-2? Best practice?

Hi there, 

you need to download the base version (no install), then download & install the preferred maintenance version

during the upgrade process you cannot skip any version, see the opening post or my own example (this was eased out in 11.0 which allows to skip versions )

If you are on latest 9.x release you just need to follow the steps in the opening post.

If you are running an HA setup with 2 nodes, you need to follow the steps i provided in a post above

  • 1 accepted solution
  • 8315 Views
  • 10 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!