Palo Alto VM-300 firewall in Azure with 40GB system disk needs 60GB for PAN-OS 10.0 upgrade

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Palo Alto VM-300 firewall in Azure with 40GB system disk needs 60GB for PAN-OS 10.0 upgrade

L0 Member

Hello all,


We have a Palo Alto VM-300 firewall in Azure which was deployed from the market place with a 40GB system disk.

To upgrade to PAN-OS 10.0 and above, the system disk needs to be a minimum of 60GB.

Has anyone done this before?

What is the best approach?



Palo Altogether

L0 Member

I want to preface this by saying that after completing the below in a DEV environment, we ended up completely swapping out with new VMs built directly on 9.1.x in PROD.  It just didn't seem like this was going to be supported by TAC.


IMO, Palo's KB (link #1) on this topic is unfortunately rather vague.  The only thing the article offers after cloning the osDisk is

  • Remove the original system disk.
  • Power on the VM-Series firewall.
It is not that simple in Azure as you cannot detach an osDisk from a VM even if it has been deallocated.  What ended up working is the following.
  1. Take a snapshot of the existing osDisk.
  2. Create a new disk that's 60GB in size using the snapshot as a source.
  3. Use method in Link #2 to swap the osDisk while the VM is deallocated.
It did appear to work as after the upgrade to 9.1.x, the new disk was partitioned correctly.
You should also be aware that we ran into a known issue with PAN-167306 (Link #3).  After the upgrade to 9.1.x, it was as if the secondary dataDisk attached for logging was completely gone.  After the step upgrades finished, another reboot from the Azure side (not the PAN-OS side) was required for the dataDisk to mount correctly.
  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!