why PAN‑OS version 12 is often considered not recommended

[bdh.185str.kl]

I would like to ask why PAN‑OS version 12 is often considered not recommended.
Is it mainly due to stability concerns during the first year following its release?
New PAN-OS 12.1 Release Cycle & 4-Year Support Policy | Palo Alto Networks
>During the initial Innovation Phase (the first 12 months), we will deliver two targeted Feature Releases (FRs) to introduce new capabilities, enhancements, and hardware support alongside standard maintenance updates. 

We are also evaluating versions 11.1 and 11.2; however, with their EOL set for 2026, the remaining support period seems quite short.

Unless there are major critical issues, our view is that version 12 may be the better option from a long-term perspective.

I would appreciate it if anyone could share their insights on why version 12 is not recommended.

[kiwi · Accepted solution]

Hi @bdh.185str.kl ,

First, a quick "peace of mind" correction on the dates—you actually have more time than you thought!

• PAN-OS 11.1 and 11.2 are not EoL in 2026. Their current End-of-Life date is actually May 2027.

  Source: https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary#pan-...
  This means you still have a solid year of support left if you choose the 11.x path today.

Palo Alto explicitly defines the first 12 months of a major release like 12.1 as the Innovation Phase. During this time, the focus is on introducing new features and hardware support. While these releases are production-ready, they haven't yet reached the "Stability Phase" (which usually kicks in after year one), where the focus shifts almost exclusively to bug fixes and long-term reliability.

Most conservative organizations wait for the "TAC Preferred" label. A release usually only earns this after it has a massive install base (often >10,000 devices) and a proven track record of no high-impact regressions. Version 12 is simply too new to have hit those metrics yet.

You are correct that 12.1 is the first version to feature the new 4-year support policy. This makes it a very attractive long-term target.

My personal recommendation:

If you need maximum stability right now, 11.1 is the mature, "Preferred" choice. However, if your project timeline allows for a few months of testing, moving to 12.1 later this year (once it moves deeper into its maintenance cycle) would give you that 4-year runway you're looking for.

Are you planning to deploy this on new hardware, or are you upgrading an existing fleet? That might make the choice for you if the new hardware requires the 12.x code!

Hope this helps,

[Brandon_Wertz]

@bdh.185str.kl like @kiwi mentioned if I were given a choice right now I'd deploy an 11.1.X version of PAN-OS, which I think right now 11.1.10hx is the preferred track. 

I've been evaluating 12.1 for a few months now and from what I've seen and conversations I've had 12.1 is going to be a much improved code base with lots of desired features that don't yet exist in earlier software versions.  Unfortunately right now 12.1 isn't yet enterprise ready.  Give it another 2-5 months and there will likely be a release of 12.1 that an enterprise customer could safely deploy.