Upgrade from 10.1.12 to 11.1.13

[Sathaporn]

Currently, I have one Panorama M-200 running OS version 10.1.12, and two PA-3220 devices running OS version 10.1.12 configured in HA Active-Passive mode. The PA-3220 devices are fully managed by Panorama, including configuration and log storage.

Now, I would like to upgrade the OS to version 11.1.13. I came across the “Skip Software Version” upgrade procedure in the Palo Alto KB, and I would like to confirm whether I can follow the steps below:

Panorama

1. Download 11.1.0 (Base Image)
2. Download 11.1.13 (Preferred Release)
3. Install 11.1.13 and reboot

PA-3220
Disable Preemption

PA-02 (Passive)

1. Download 11.1.0 (Base Image)
2. Download 11.1.13 (Preferred Release)
3. Install 11.1.13 and reboot

PA-01 (Active)

1. Suspend PA-01 to make PA-02 active
2. Download 11.1.0 (Base Image)
3. Download 11.1.13 (Preferred Release)
4. Install 11.1.13 and reboot

Is this procedure correct for a Skip Software Version upgrade?
Also, is there any function or feature that needs to be enabled beforehand to perform a Skip Software Version upgrade?

Thank you.

[TomYoung]

Hi @Sathaporn ,

You can upgrade directly from PAN-OS 10.1 to 11.1.  Please refer to the table here -> https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan....

Your procedure is correct.

There is no function or feature that needs to be enabled beforehand to my knowledge.  It is always a good idea to review the Upgrade/Downgrade Considerations link which is directly above the table.

Thanks,

Tom

[Sathaporn]

Hi @TomYoung 

Thank you for the recommendation. I have another question: in the case of rolling back from version 11.1.13 to 10.1.12, can I simply install OS version 10.1.12, load the configuration file from version 10.1.12, and reboot to apply the previous OS version?

Thank you,

[nohash4u]

Hi @Sathaporn, 

I would advise that when reverting from 11.1.13 to 10.1.12 you complete the downgrade process first (install and reboot), and then load the configuration file from version 10.1.12. 

[TomYoung]

Hi @Sathaporn ,

You must downgrade to 11.0, 10.2, and then 10.1.  As @nohash4u said, it is best to save your 10.1 configuration before upgrading, and keep it in case you need to downgrade.

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-panorama/install-content-and-so...

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-upgrade/upgrade-panorama/install-content-and-so...

If my original reply answered your question, please mark it as the solution!

Thanks,

Tom

[Sathaporn]

Hi @TomYoung 

I’m a bit confused. When upgrading using the Skip Software Version method, it’s possible to jump directly from 10.1.12 to 11.1.13. However, when downgrading, why is it necessary to go through 11.0, 10.2, and then 10.1?

Based on this KB, I’m not sure whether it is actually possible to downgrade directly from 11.1.13 back to 10.1.12 in a single step.

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/downgrade-pan-os/downgra...

There is a note in the KB stating that: "To downgrade from PAN-OS 11.1 to an earlier PAN-OS release, you must download and install PAN-OS 10.1.3 or later PAN-OS 10.1 release before you can continue on your downgrade path to your target PAN-OS release. Downgrade from PAN-OS 11.1 fails if you attempt to downgrade to PAN-OS 10.1.2 or earlier PAN-OS 11.1 release."

Thank you.

[TomYoung]

Hi @Sathaporn ,

Cool!  That is better than the documents that I found.  Yours must be newer.

Thanks,

Tom