Hello @watkfr
As @reaper mnetioned you can skip up to 3 version when you upgrade a individual firewall.
"When upgrading HA firewalls across multiple feature PAN-OS releases, you must upgrade each HA peer to the same feature PAN-OS release on your upgrade path before continuing. For example, you are upgrading HA peers from PAN-OS 10.2 to PAN-OS 11.1. You must upgrade both HA peers to PAN-OS 11.0 before you can continue upgrading to the target PAN-OS 11.1 release. When HA peers are two or more feature releases apart, the firewall with the older release installed enters a suspended state with the message Peer version too old. "
https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-upgrade/upgrade-pan-os/upgrade-the-firewall-pan-os/upgrade-an-ha-firewall-pair
So, according with the above statement from TECH DOCS, you will need first to upgrade both HA peers to 11.0.x and after that to 11.1.x.
If the firewall with older release enters to suspend state before the other peer to be fully functional, then you will have service interruption.
Even PAN-OS 11.0 it's end of support, you still need to use it as transitional state.
1. download 11.0.0
2. download 11.0.4-h6 (the latest preferred release from 11.0) + install
3. reboot the first firewall
4. repeat steps 1-2 for second firewall and reboot second firewall
4. download 11.1.0
5. download 11.1.4-h7 (the latest preferred release from 11.1) + install
6. second reboot for first firewall
7. repeat steps 5-6 for second firewall
8. second reboot for the second firewall
Each HA peer will have 2 reboots.
... View more