Upgrade VM Panorama and VM FWs from 9.1x to 10.1.x - verification

[PA_nts]

Hi All,

so planning to upgrade a single VM Panorama and a number of VM-100/300 Firewalls in Azure

Just want to clarify my upgrade sequence is good pls.

current version - 9.1.9

Expected version 10.1.10-h2

Panorama VM upgrade plan:

upgrade from 9.1.9 > 9.1.16

upgrade from 9.1.16 > 10.0

upgrade from 10.0 > 10.0.11-h1

upgrade from 10.0.11-h1 > 10.1.0

upgrade from 10.1.0 to 10.1.10-h2

Panorama does not have internet access so will manually download the updates from Palo Alto SCP

Under Updates/Software Updates i select the 'Panorama Updates' form the drop down - the images to download

are all 'Panorama_pc-x.x.x'

upload these to Panorama and good to go.

with the VM Firewalls - will download images via software update option and upgrade that way.

Just need to clarify that I didn't miss anything and my upgrade sequence is good?

will do backups and health checks etc before/after each backup so that is covered.

thanks in adv

[BPry · Accepted solution]

@PA_nts,

You don't list if you're installing and rebooting into each release or just installing. You're upgrade path is available at https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan... so that you can validate things, but it looks like this:

• Download and install 9.1.16-h3 (the latest maintenance release) and reboot.
• Download 10.0.0
• Download and install 10.0.12-h1 (the latest maintenance release) and reboot
• Download 10.1.0
• Download and install 10.1.10-h2 (the latest maintenance release) and reboot

I personally actually wouldn't recommend doing major PAN-OS upgrades on Azure VMs if you don't need to. I've run into multiple issues doing major updates and just started to rebuild these VMs when needed and moving the objects over to the new host. I found this to be far less disruptive and time consuming than dealing with the issues that major upgrades introduced to those instances. Since you're able to migrate IPs and everything else with ease rebuilding doesn't take long at all. 

[PA_nts]

Thanks BPry,

we looked at the VM build option but had pushback from the Azure teams - so will use that option as a last resort.

so this is my take then on the process

• Download and install 9.1.16-h3 (the latest maintenance release) and reboot.
• Download 10.0.0 (this is just a download required and not an actual upgrade to 10.0, so no upgrade/reboot needed here)
• Download and install 10.0.12-h1 (the latest maintenance release) and reboot
• Download 10.1.0 (as above, this is just a download required and not an actual upgrade to 10.1 again no upgrade/reboot needed here)
• Download and install 10.1.10-h2 (the latest maintenance release) and reboot

thanks in adv

[OtakarKlier]

Hello,

You are correct in your understanding of the process.

Cheers!