VMWare ESXi PAN-OS upgrade: from 8.0.7 to 8.1.3 ->Active/Passive HA (without Panorama)

[ash83]

Hi community,

Having reviewed:

https://www.paloaltonetworks.com/documentation/81/pan-os/newfeaturesguide/upgrade-to-pan-os-81/upgra...

and

https://www.paloaltonetworks.com/documentation/81/pan-os/newfeaturesguide/upgrade-to-pan-os-81/upgra...

Is this the right upgrade path to be followed?

A)

8.0.7 to 8.0.12

8.0.12 to 8.1.1

8.1.1 to 8.1.3

or (skipping 8.0.12 to 8.1.1-> unsure whether or not this is required)

B)

8.0.7 to 8.0.12

8.0.12 to 8.1.3

And lastly, what is a feature realease? :"When you upgrade from one PAN-OS feature release version to a later feature release, you cannot skip the installation of any feature release versions in the path to your target release." 

Thanks.

[BPry]

@ash83,

So you would actually use the following upgrade path. 

8.0.7 -> Whatever the latest maintenance release is for 8.0.x

8.0.x -> 8.1.0 (base) 

8.1.0 -> 8.1.3

Palo Alto no longer recommends jumping directly to the target maintenance release within the next major version due to having to explode both images to build the installer. This takes up a lot of disk space and makes it more likely that a bit here or a bit there will get out of place. 

So whenever you install a major software update you'll want to upgrade to whatever the latest maintenance release is; then upgrade to the base of the next major software release, and then finally update to the target maintenance release in that version.

A feature release is a major software version; so 7.0, 7.1, 8.0, 8.1 are all feature releases. 8.1.1 for example would be a maintenance release. What that note is saying is essentially; if you're running 7.0 and you want to upgrade to 8.1, you can't skip 7.1 and 8.0 to get there. 

[ce1028]

Interesting and great into.

Prior you could go this route.

8.0.7 -> whatever the latest maintenance release is for 8.0.x

8.1.0 (base) - download only but not install

8.1.x - install

This was always hit or miss, I guess that's why they changed it

[BPry]

@ce1028,

That was an old recommendation, and one that Palo Alto has since moved away from. The issue with that install method is that both the 8.1.0 and the 8.1.* maintenance release that you're actually installing need to be exploded onto the disk, and then a functional install image is built with bits and pieces from both images. This takes drastically more disk space then a simple install in the current recommendation and causes a better chance that something will go wrong. 

* Just as a side note, most people that had an issue with simply downloading the base image and then installing the maintenance release were using the smaller platforms (PA-200, PA-3000, ect). However it really comes down to available diskspace, to be safe they simply changed the recommendation for everyone. I would still highly recommend you follow the new recommendation. 

[ce1028]

@BPry Indeed!  I've been following the procedure you posted for some time now. No issues at all.  Yes, I run a lot of 200s,3000s

[ash83]

Thanks BPry, excellent assistance.