Upgrade path from PANOS 9.0.17-h5 to 10.1.13-h1

[deepakkumar29]

Hi Experts, 

I'm going to upgrade from PANOS 9.0.17-h5 to 10.1.13-h1. Could you please advise me the download and install path. Additionally, Tell me how many reboots. It would require reaching out to 10.1.13-h1. 

Moreover, can you please help in order to prepare a plan, we need to determine how much time to request for the change window and the expected duration for a reboot cycle. 

[zahmed01]

Hello @deepakkumar29 ,

The upgrade path would be as follows:

• Download and install the latest preferred PAN-OS 9.1 maintenance release and reboot.
• Download PAN-OS 10.0.0.
• Download and install the latest preferred PAN-OS 10.0 maintenance release and reboot.
• Proceed to Upgrade the Firewall to PAN-OS 10.1.

However I would recommend you take a look at the End of Life for PANOS versions to see when 10.1 will go EOL and compare with 10.2 or even 11.1.  This will give you an idea of the updated PANOS versions available to help reduce how many times you will need to go through an entire upgrade path in the next 1-2 years or so.  

It can be difficult to determine how long a change window should last so I would recommend perhaps testing the upgrade in a lab environment to get a potential idea of how long the process can take. 

Thanks,

[deepakkumar29]

Thank you. So, it would require 3 reboots to reach 10.1.13-h1.  right ?

[deepakkumar29]

Hi,

Could you please share the roll back steps and how many reboot require during this roll back steps

[RomainSalmon]

Hello,

I have upgraded from 9.1 to 10.2 and it have taken 5hours (including debug for a new functionality). 3 reboots were needed.

I really advise you to check new features via release notes to be sure that you will have no impact. I strongly suggest that you opened a tac before your operation in order that if you have a problem the tac will be available straight.

Back up configuration and device state before every upgrade.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-pan-os/downgrade-pan-os/downgra...

For the rolll back u may have to do 3 reboots in order to be safe : 10.1.x--->10.0.x--->9.1.x

FYI : "While upgrading to PAN-OS 10.1, the firewall may perform a file system integrity check (FSCK), displaying the following message: RAID log disks check in progress, please wait.
The FSCK is required for the upgrade and may take an hour or more. Do not reboot or attempt to install another software release while the FSCK is in progress". 

[deepakkumar29]

Thank you. Just one more query, do i need to perform dynamic upgrade after each version update and reboot ?

[RomainSalmon]

Are you talking about the dynamic updates ? If yes, it's a best practice to do it before the upgrade and to check that your passive firewall gets the same version.