upgrading PAN-OS

[Ndexsystems]

Hi 

I want to upgrade the 8.1.x to the latest version , after two upgrade stay on 8.1.24. I tried to move to 9.0.X but failed. Could you please let me know how I can upgrade to 9.x? (As information that I have find need the Preferred release It means 8.1.25, but I cann't find it)

Thanks

[aleksandar.astardzhiev]

Hi @Ndexsystems ,

Palo Alto upgrade path is listed here - https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan...

As mentioned from the link above it is recommended (not acutally mandatory) to upgrade first to the latest maintenance release.

As described here - https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-... 8.1 is End-of-Life, except for some hardware platforms. So if there is no 8.1.25, it means such is not available for your device.

Upgrading from 8.1.24 to 9.0 shouldn't be a problem. If you upgrade from 8.1 to 9.0 has failed I would suggest to troubleshoot the reason. Can you share more details of the failed upgrade and why you decided to roll back to 8.1?

[Ndexsystems]

I don't want to roll back to 8.1 ,  going for last version 11 .. this is error message that I received when upgrading to 9.0.0: "Upgrading from 8.1.24 to 9.0.0 requires content version of 8103 or greater and found 769-4439 "

[aleksandar.astardzhiev]

Hi @Ndexsystems ,

The error message should be self-explainatory - every major upgrade requires minimum supported version for dynamic content updates. This is also explained here - https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-pan-os/pan-os-upgrade-checklist

Verify the minimum content release version.

Minumum content release version is listed in the release notes for each major version - https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-release-information/ass...

My personal opinion is to always keep the content version to the latest, so instead of installing the minimum, just update the content update to the latest available.

Does your FW has internet connection? Does it has valid support license? If yes, you can update the content update directly from the firewall.

If no intenet connection, you can download content update from support portal and upload it manually.

[daubsi]

I am running in exactly this problem that upgrading from 8.1.x to 9.0 required at least a content update pack of version 8103, however the firewall still has an ancient 3-digit version content pack, apparently from 8.0. I installed the FW to the latest 8.1.26-h2 software update, but am stuck here now. While the support portal let's me download all software version for the last 4+ years, the content pack versions offered are only those from the last two month. I tried installing the oldest content pack available in the portal (8916-9089), but the upload just stays there saying "uploading" for 30 minutes without any progress. Is there a way to get hold of the minimum required version 8103 so I can bring the FW to v9.0.0 and keep upgrading from there? 

[BPry]

@daubsi,

You'll want to call TAC and get 8103 from them. Once you have that installed, you should be able to update to 8916 and then get back into automatic updates.