Safe to upgrade to PAN-OS 11.1.6-h20?

[N.Harjo]

Was sent a recommendation by our cyber guy to upgrade from current PAN-OS version 10.2.14-h1 to 11.1.6-h20.  Read about some issues with 11.1.6 and wanted to get expert input on this version.  Thank you!!

[BPry]

@N.Harjo,

What hardware do you have? The PA-5200s and PA-3200s I'm still seeing pretty major issues both personally and documented online. I also wouldn't personally be rushing to 11.1 at this point and just target 11.2 in the vast majority of instances if you're performing a major version update.

Cybersecurity professionals that don't detail their recommendations are not properly doing their jobs in my opinion. If they're asking you to perform a major version update they should be detailing why; if they are telling you to run a specific maintenance target that isn't even a preferred release then I have even more questions. 

What they are likely recommending you upgrade for is due to PAN-OS 10.2 reaching a Limited Support status with absolutely appalling commitments from PAN when 11.1 and 11.2 still have stability issues on the two platforms mentioned above. We don't know what PAN's practical support for 10.2 is going to be since this is a new status that they just started using, but they did just release 10.2.17. That could be the very last maintenance release that isn't just a hotfix, or it could be what we should expect going forward, we just don't know. 

PAN-OS 11.1 and 11.2 have been very hardware and configuration specific and neither release is something that I would blindly recommend someone install without at least knowing what platform they're running at the moment. Keep in mind here that even PAN is marking 11.2.4-h7 as the preferred release and 11.2.9 is out; 11.1.10-h1 is the current recommended release in that branch, I'm not sure where he's pulling the 11.1.6-h20 recommendation.

So I guess the biggest question that I would have is what hardware are we actually talking about here?