PAN OS upgrade from 8.1.15 to 9.1.12-h3

[SetoChiShun]

Hi, 

My client is planning to upgrade their Panorama and PA5220 (x4) current PAN OS v8.1.15 to 9.1.12-h3.

Panorama > PA5220 x2 (HA) 

                  > PA5220 x2 (HA)

Just want a second opinion of below upgrade path is correct or not, and other pre-cautionary advise.

1. download 9.0
2. download and install and reboot 9.0.14-h3
3. download 9.1.0
4. download and install and reboot 9.1.12-h3

Upgrade Panorama first then upgrade PA5220 HA (passive) then failover to active, upgrade PA5220 HA (passive)

Not sure above steps can rollback to 8.1.15, please recommend.

[laurence64 · Accepted solution]

HI 

The path looks good to me to be honest, it follows the suggested method as shown here  as for the roll back I suspect that there will be some migration involved with those versions but the upgrade/downgrade considerations can be found here

Hope this helps.

[kiwi · Accepted solution]

Hi @SetoChiShun ,

As @laurence64 mentioned, the upgrade path looks good.

Note however, that reverting back (using the command debug swm revert) is not possible between major versions (only possible between minor versions).

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcYCAS

Hope this helps,

-Kiwi.

[SetoChiShun · Accepted solution]

Noted and thanks for your advise, Kiwi

[SetoChiShun]

... additional device Log Collector (M600) that need to upgrade from v8.1.15 to v9.1.12-h3

Panorama - M600 > PA5220 x2 (HA) 

                  > PA5220 x2 (HA)

[SetoChiShun]

... for M600 upgrade via Panorama,

1. download 9.0
2. download and install and reboot 9.0.14-h3
3. download 9.1.0
4. download and install and reboot 9.1.12-h3

Any advise on upgrade path for both Panorama & M600....

On upgrade path, please advise whether to perform device side-by-side download/install Panorama & M600 to 9.0.14-h3 then download/install 9.1.12-h3 OR upgrade panorama (8.1.15 > 9.0.14-h3 > 9.1.12-h3) then M600 (8.1.15 > 9.0.14-h3 > 9.1.12-h3)?

BTW, I cannot find any downgrade (fallback) procedures on M600, please advise whether M600 can downgrade to previous version once upgrade 9.0.14-h3 or 9.1.12-h3?