Upgrade to PANOS 7.1

[RustyPA]

I'm looking at getting a Palo Alto used.  A lot of the units are pan os 4, 5 or 6.  For a PA-500, for example, can I get a 5.x OS and upgrade it to 7.1?  Does this require a support contract to upgrade it?

[yasirirfan]

Hi RustyPA

In order to downlaod the PAN-OS one should have an access to Palo Alto Support portal. As far as I remember you can register yourself using the serial number of the PA-500 you have. Once you register you are allowed to download PAN-OS for the hardware platform you have. 

Support contract is needed when you seek Palo Alto TAC team support , so technically its not mandatory to have a support contact to download the PAN-OS. 

Cheers

Yasir

[gwesson · Accepted solution]

@RustyPA There's a certification process for secondary-market purchases as well, it's explained in detail here:

https://www.paloaltonetworks.com/services/support/support-policies/secondary-market-policy

@yasirirfan A device without a support licence will not install new PAN-OS software, so the support license is indeed needed to upgrade PAN-OS. The support license is not needed to upgrade the app-only content. Apps + threats needs a threat license to install the updates.

@RyanZartman You can download PAN-OS from the support portal, but the device must first have a verified support license. Without the license, the upgrade will fail with a support license error.

Cheers,

Greg

[Transporter]

Halo,

Please read below.

https://live.paloaltonetworks.com/t5/Management-Articles/Is-it-possible-to-upgrade-PAN-OS-without-a-...

Yes, it is possible to upgrade device without a support licences.

Cheers 

[kiranmungikar]

I am using PA3050 need to upgrade from  6.1.9 to 7.1.21

I just need to know the OS version path for upgrade.

Also if any case if i need to backout the change to original 6.1.9 from 7.1.21 whats the OS path I should follow.

[BPry]

@kiranmungikar

6.1.9 -> Download and install 6.1.19

6.1.19 -> Download and install 7.0.1 

7.0.1 -> Download and install 7.0.19

7.0.19 -> Download and install 7.1.0

7.1.0 -> Download and install 7.1.21

You won't have any easy downgrade path due to the number of versions you are upgrading through. 7.1.21 is very proven and stable at this point; if you run into issues I would recommend working through them instead of attempting to downgrade the firewall multiple major versions like that. 

[kiranmungikar]

I am using PA-200 upgrading to 7.0.1 from 6.1.22

Getting following error message when i try to install 7.0.1

Failed to install PanOS_200-7.0.1 with the following errors SW version 7.0.1

Error: upgrading from 6.1.22 to 7.0.1 requires a content version of 497 or greater and found 494-2664. failed to install version 7.0.1

Please assist

[netrunnercl]

Hello,

you need to update your app version, go to Device > Dynamic updates. Its on Applications and threats

Error: Upgrading from 7.0.1 to 7.1.0 requires a content version of 564 or gre
ater and found 497-2688

The minimun would be 564.

I installed 599-3443 and did the job.