Upgrading PanOS from v5 to v6

[wocomike]

Hi,

We're currently running codebase 5.0.11, and would like to go to 6.0.3.

Here are a few questions I have.

1)  This is a fairly new install.  When we migrated our config from our ASA to the PAN, the only reason I didn't go to the 6.0 codebase is because some of our objects didn't move over properly.  For instance, Service Groups and Address Groups were all empty.  When I migrated to the 5.0 codebase, it imported them correctly.  I just want to make sure that it was a problem with the migration tool, and not something that 6.0 can't handle period.  Has anyone upgraded to 6.0 with service and address groups in tact?

2)  Can I go directly to 6.0.3, or do I have to load 6.0 first, and then go to 6.0.3?

Thanks in advance!

-Mike

[ajbool]

I've not done 5.x to 6.0.3 yet - but I have updated a lot of boxes from 4.x to 5.x.

I'm pretty sure you need to first install 6.0.0 after which you can install 6.0.3.  This is because update images such as 6.0.3 don't contain the whole operating system.

If you look at the PANOS image sizes you can see that the 6.0.0 image for PA500 is 353MB; whereas the 6.0.3 is 207MB....  If you try to just go straight to 6.0.3 you would be missing out on 150MB of PANOS goodness!  (Although the firewall will probably reject the install as far as I recall...)

[gswcowboy]

You would only need to download the 6.0.0 base image and then proceed with a download and install of 6.0.3 soon thereafter. If you're seeing issues on your config, I usually run the following upon a reboot of a major PANOS. Upon completion of the reboot and autocom job has completed, go into configure mode of your device and perform the following. This may assist with any possible anomalies that crop up with the config xml file upon a major upgrade.

admin@Lab11-PA3020> configure

Entering configuration mode

[edit]

admin@Lab11-PA3020# commit force

....55%99%.....100%

Configuration committed successfully

admin@Lab11-PA3020# exit

Exiting configuration mode