: PAN-OS Upgrade Checklist
Focus
Focus

PAN-OS Upgrade Checklist

Table of Contents

PAN-OS Upgrade Checklist

What do I need to plan my PAN-OS upgrade?
Planning your PAN-OS upgrade can help ensure a smoother transition to a newer version of PAN-OS for your Panorama or firewalls.
  • Make sure the device is registered and licensed.
  • Verify the available disk space.
    The disk space required varies based on the PAN-OS release. Select
    Device
    Software
    and review the target PAN-OS release
    Size
    to determine the required disk space.
    • Run
      show system disk-space
  • Verify the minimum content release version.
  • Identify the preferred release.
    See the Palo Alto Networks Support Software Release Guidance and End-of-Life Summary for more information. Additionally, review the known and addressed issues, upgrade and downgrade considerations, and limitations for your target PAN-OS release to understand how a PAN-OS upgrade may impact you.
  • Determine the upgrade path.
    When you upgrade from one PAN-OS feature release version to a later feature release, you cannot skip the installation of any feature release versions in the path to your target release.
  • Review the upgrade/downgrade considerations for all releases in your upgrade path.
  • (
    Required for GlobalProtect
    ) Verify the minimum GlobalProtect™ agent version to prevent GlobalProtect users from losing VPN connectivity. GlobalProtect can be upgraded directly to the latest version.
  • Verify the minimum plugin release versions on the target release version for any plugins you have installed.
  • Verify connectivity from the management interface to the update server.
    • Select
      Device
      Troubleshooting
      and test the
      Update Server Connectivity
      to check that the DNS can resolve the address.
      If it doesn’t resolve, change the DNS to
      8.8.8.8
      (you need to use a public DNS server rather than your own DNS server) and ping again.
      If this doesn’t resolve, change the update server to
      staticupdates.paloaltonetworks.com
      and
      Commit
      .
  • (
    SD-WAN only
    ) Identify the hub and branch firewalls you intend to upgrade to PAN-OS 10.2.
    To preserve an accurate status for your SD-WAN links, you must upgrade your hub firewalls to PAN-OS 10.2 before you upgrade your branch firewalls. Upgrading branch firewalls before hub firewalls may result in incorrect monitoring data (
    Panorama
    SD-WAN
    Monitoring
    ) and for SD-WAN links to erroneously display as
    down
    .
  • If there are any plugins currently installed, download the plugin version supported on PAN-OS 10.2 for all plugins currently installed on Panorama (
    Panorama
    Plugins
    ) or your firewall (
    Device
    Plugins
    ) before upgrade.
    See the Panorama Plugins Compatibility Matrix for the Panorama plugin version supported on PAN-OS 10.2.
    This is required to successfully upgrade Panorama and firewall from PAN-OS 10.2 to PAN-OS 10.2. The downloaded plugin version is automatically installed during upgrade to PAN-OS 10.2. Upgrade to PAN-OS 10.2 is blocked if the supported plugin version is not downloaded.

Recommended For You