Upgrading PAN-OS 8.1.x to 9.1.10

[jirasith]

I want to upgrade PA-3220 (Active - Passive) from 8.1.14 to 9.1.10

Is this upgrade method correct or not?
1.Download and install PanOS 9.0.0 (no reboot)        Should I upgrade PanOS to 8.1.19 (Preferred release) or not?
2.Download and install PanOS 9.0.13 and reboot
3.Download and install PanOS 9.1.0 (no reboot)
4.Download and install PanOS 9.1.10 and reboot

I'm not sure the step to rollback 9.1.10 to 8.1.14. Can you help recommend steps to downgrade?

[vsys_remo · Accepted solution]

Hi @jirasith 

(Firewall A = currently active firewall, firewall B = currently passive firewall)

1. Download PAN-OS 8.1.19 to both firewalls
2. Install 8.1.19 and reboot firewall B
3. Download PAN-OS 9.0.0 to firewall B
4. Download PAN-OS 9.0.13, install it and reboot firewall B
5. Install PAN-OS 8.1.19 on firewall A and reboot (when you click reboot a failover is done to firewall B)
6. Download PAN-OS 9.0.0 to firewall A
7. Download PAN-OS 9.0.13, install it and reboot firewall A
8. Download PAN-OS 9.1.0 to both firewalls
9. Download PAN-OS 9.1.10 to both firewalls
10. Install PAN-OS 9.1.10 on firewall A and reboot (when you click reboot a failover is done to firewall B)
11. Install PAN-OS 9.1.10 on firewall B and reboot

To make sure that you can downgrade in case of any problems export the configuration at all of the following steps on both firewalls:

• Installation of 8.1.19
• Installation of 9.0.13

[jirasith]

@vsys_remo Thank you for the advice. If I have to downgrade the firmware version from 9.1.10 to  8.1.19.  Can I revert the upgrade path such as 

1.Download and install 9.0.13  

2.Download and install 9.0.0 and reboot

3.Download and install 8.1.19 and reboot

or Can I directly download and install  8.1.19?

[vsys_remo]

@jirasith In case of a downgrade you first go to 9.0.13 and then to 8.1.19. You don't need the step to install and reboot for the version 9.0.0.

[jirasith]

@vsys_remoThanks a lot.