Hi @herman2018 ,
You can download the image directly from the firewall. The requirements are only to have internet connectivity on the firewall (HTTPS and DNS). By default the firewall will use its OOB/dedicated management interface to reach Palo Alto update server. But if your management network doesn't have internet connectivity you can use one of the dataplane interfaces.
If the firewall is completely isolated from the internet (neither direct nor over proxy), you can manually upload the new image. You can download the image from the support portal. https://support.paloaltonetworks.com/Support/Index You have to login with your account associated with firewall license. Once you login go to Updates > Software Updates > Select your device > select the version to which you want to upgrade.
Note that if you plan to upgrade to new feature release you need to download the base image and the latest patch image
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!