Upgrade path from PANOS 10.2.8-h3 to 11.1.2-h3

[deepakkumar29]

Hi Experts, 

I'm going to upgrade from PANOS PANOS 10.2.8-h3 to 11.1.2-h3. Could you please advise me the download and install path. Additionally, Tell me how many reboots. It would require reaching out to 11.1.2-h3.

Thanks in advance

[CosminM]

Hello @deepakkumar29 

Please have a look here:

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan... 

[deepakkumar29]

Thank you Yes, it says, we can directly upgrade to 11.1. But in same document it is mentioned at top --> When you upgrade from one PAN-OS feature release version to a later feature release, you cannot skip the installation of any feature release versions in the path to your target release. In addition, the recommended upgrade path includes installing the latest maintenance release in each release version before you download the base image for the next feature release version. To minimize downtime for your users, perform upgrades during non-business hours.

[CosminM · Accepted solution]

Hello,

"When you upgrade from one PAN-OS feature release version to a later feature release, you cannot skip the installation of any feature release versions in the path to your target release." - and the path to your target release is detailed on STEP 3.

Also, the recommend upgrade path include installing the latest preferred maintenance release from 10.2.x.

Now (when I'm writing), this preferred maintenance release is 10.2.9-h1 - Support PAN-OS Software Release Guidance 

In the Customer Support Portal you can see what the preferred versions for a specific platform are.

Before any upgrade I highly recommend reading the release note of the version.

So, in your case the steps could be:

- check to be compliant with the required content updates (Associated Content and Software Versions for PAN-OS 11.1 )

- download and install the recommended maintenance release 10.2.9-h1 (first reboot)

- only download 11.1.0

- download and install 11.1.2-h3 (second reboot)

Before any upgrade I highly recommend reading the release note of that new version.

[deepakkumar29]

Thank you, it makes sense now. 

[Cluster8]

I have a question if it is necessary to install the preferred version of 11.0 and if it is necessary to follow the following route?

Preferida 10.2.9-h1 Download and Install
Base 11.0 Solo se descarga
Preferida 11.0.4-h2 Download and Install
Base 11.1 Solo se descarga
Preferida 11.1.2-h3 Download and Install

I have no idea if they skipped firmware version 11.0.X?

[Jpergolizzi]

I am in the process of performing almost this exact upgrade as I am writing this on an PA-850 HA pair. It has always been my understanding that to get into the next codestream you must install the initial feature release. I am upgrading from 10.2.9-h1 to 11.2.1-h3 so my process it:

1. Upgrade first to 11.0.0

2. Upgrade next to 11.1.0

3. Final upgrade to 11.2.1-h3

Since I am jumping codestreams like this, I will make sure all my dynamic updates are current after the 11.1.0 upgrade.

Also, always make sure to save a config backup and tech support backup as well as the device state, etc and export them off of the firewalls.

[TomYoung]

Hello @Cluster8 and @Jpergolizzi ,

You can now skip versions when upgrading to PAN-OS 11.x.  https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features/management-features/skip-software-...

Thanks,

Tom

[Jpergolizzi]

Thanks Tom, thats good!

Jim

[CosminM]

Hello @Cluster8 and @Jpergolizzi ,

Depending on starting and targeting PAN-OS version you need to determine the upgrade path.

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan... 

[Jpergolizzi]

Cosmin, thanks for sending this on. I was coming from 10.2.9 so was able to upgrade directly to 11.1. Since I was already in the process and had gone to 11.0, I just continued through the release versions to 11.1.2-h3 (i.e. 11.0.0, then 11.1.0). It all worked but the next time I believe I should be able to go direct into the next codestream so will try that. Thanks!

Jim