Hi Mate, Its not about teh quickest, but the safest way should be preferred. Better option is option 1, upgrade both firewalls one by one before moving to the next version. This will help you test failover at each step and also ensure you are not hitting any issues. With option 2, if there are any issues with upgrade on version 9.1.2, you will have to downgrade again all the way to 8.1.7. here is the document that will help you: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/upgrade-to-pan-os-91/upgrade-the-firewall-to-pan-os-91/upgrade-an-ha-firewall-pair-to-pan-os-91.html Step 6 & 7 needs to repeated for every interim version you upgrade to till the final target version. Regards, Varun Rao
... View more