>
    Strata Copilot
    Upgrade the PAN-OS Software Version for VM-Series NSX
    Focus
    Download PDF
    Focus
    1. Home
    2. VM-Series
    3. Upgrade the PAN-OS Software Version for VM-Series NSX
    Download PDF
    VM-Series

    Upgrade the PAN-OS Software Version for VM-Series NSX

    Table of Contents

    Upgrade the PAN-OS Software Version for VM-Series NSX

    Learn about the upgrade methods for VM-Series for NSX.
    Where Can I Use This?What Do I Need?
    • VM-Series firewall deployment
    • VM-Series 10.2.x or above
    • Panorama running PAN-OS 10.2.x or above
    Choose the upgrade method that best suits your deployment.
    The following graphics display the currently supported combinations of Panorama and the Panorama plugin for VMware NSX, as well as the upgrade paths you're required to follow to upgrade successfully.
    • Each box below represents a supported combination.
    • When upgrading the Panorama plugin for NSX or Panorama in an HA pair, upgrade the passive Panorama peer first, followed by the active HA peer.
    Before upgrading your VM-Series for VMware NSX deployment, review the upgrade paths shown below to understand the upgrade steps to arrive at the plugin and PAN-OS combination that best suits your environment.

    Upgrade the VM-Series for NSX During a Maintenance Window

    For the VM-Series firewall NSX edition, use Panorama to upgrade the software version on the firewalls.
    1. Review the VM-Series for VMware NSX upgrade paths.
    2. Allocate additional hardware resources to your VM-Series firewall.
      Verify that enough hardware resources are available to the VM-Series firewall. Refer to the VM-Series System Requirements to see the new resource requirements for each VM-Series model. Allocate additional hardware resources before continuing the upgrade process. The process for assigning additional hardware resources differs on each hypervisor.
    3. Save a backup of the current configuration file on each managed firewall that you plan to upgrade.
      Although the firewall will automatically create a backup of the configuration, it's a best practice to create a backup prior to upgrade and store it externally.
      1. Select DeviceSetupOperations and click Export Panorama and devices config bundle. This option is used to manually generate and export the latest version of the configuration backup of Panorama and of each managed device.
      2. Save the exported file to a location external to the firewall. You can use this backup to restore the configuration if you have problems with the upgrade.
    4. Check the Release Notes to verify the content release version required for the PAN-OS version.
      The firewalls you plan to upgrade must be running the content release version required for the PAN-OS version.
      1. Select PanoramaDevice DeploymentDynamic Updates.
      2. Check for the latest updates. Click Check Now (located in the lower left-hand corner of the window) to check for the latest updates. The link in the Action column indicates whether an update is available. If a version is available, the Download link displays.
      3. Click Download to download a selected version. After successful download, the link in the Action column changes from Download to Install.
      4. Click Install and select the devices on which you want to install the update. When the installation completes, a check mark displays in the Currently Installed column.
    5. Deploy software updates to selected firewalls.
      If your firewalls are configured in HA, make sure to clear the Group HA Peers check box and upgrade one HA peer at a time.
      1. Select PanoramaDevice DeploymentSoftware.
      2. Check for the latest updates. Click Check Now (located in the lower left-hand corner of the window) to check for the latest updates. The link in the Action column indicates whether an update is available.
      3. Review the File Name and click Download. Verify that the software versions that you download match the firewall models deployed on your network. After successful download, the link in the Action column changes from Download to Install.
      4. Click Install and select the devices on which you want to install the software version.
      5. Select Reboot device after install, and click OK.
      6. If you have devices configured in HA, clear the Group HA Peers check box and upgrade one HA peer at a time.
    6. Verify the software and content release version running on each managed device.
      1. Select PanoramaManaged Devices.
      2. Locate the device(s) and review the content and software versions on the table.

    Upgrade the VM-Series for NSX Without Disrupting Traffic

    Use the following procedure to upgrade the PAN-OS version of the VM-Series firewalls in your VMware NSX environment. This procedure allows you to perform the PAN-OS upgrade without disrupting traffic by migrating VMs to different ESXi hosts.
    1. Review the VM-Series for VMware NSX upgrade paths.
    2. Save a backup of the current configuration file on each managed firewall that you plan to upgrade.
      Although the firewall will automatically create a backup of the configuration, it's a best practice to create a backup prior to upgrade and store it externally.
      1. Select DeviceSetupOperations and click Export Panorama and devices config bundle. This option is used to manually generate and export the latest version of the configuration backup of Panorama and of each managed device.
      2. Save the exported file to a location external to the firewall. You can use this backup to restore the configuration if you have problems with the upgrade.
    3. Check the Release Notes to verify the content release version required for the PAN-OS version.
      The firewalls you plan to upgrade must be running the content release version required for the PAN-OS version.
      1. Select PanoramaDevice DeploymentDynamic Updates.
      2. Check for the latest updates. Click Check Now (located in the lower left-hand corner of the window) to check for the latest updates. The link in the Action column indicates whether an update is available. If a version is available, the Download link displays.
      3. Click Download to download a selected version. After successful download, the link in the Action column changes from Download to Install.
      4. Click Install and select the devices on which you want to install the update. When the installation completes, a check mark displays in the Currently Installed column.
    4. Download the PAN-OS image to all VM-Series firewalls in the cluster.
      1. Log in to Panorama.
      2. Select PanoramaDevice DeploymentSoftware.
      3. Click Refresh to view the latest software release and also review the Release Notes to view a description of the changes in a release and to view the migration path to install the software.
      4. Click Download to retrieve the software then click Install.
        Don't reboot the VM-Series firewalls after installing the new software image.
      5. Select the managed devices to be upgraded.
      6. Clear the Reboot device after install check box.
      7. Click OK.
    5. Upgrade the VM-Series firewall on the first ESXi host in the cluster.
      1. Log in to vCenter.
      2. Select Hosts and Clusters.
      3. Right-click the host and select Maintenance ModeEnter Maintenance Mode.
      4. Migrate (automatically or manually) all VMs, except the VM-Series firewall, off of the host.
      5. Power off the VM-Series firewall. This should happen automatically upon entering maintenance mode on the host.
      6. (Optional) Assign additional CPUs or memory to the VM-Series firewall before continuing with the upgrade process.
        Verify that enough hardware resources are available to the VM-Series firewall. Refer to the VM-Series models to see the new resource requirements for each VM-Series model.
      7. Right-click the host and select Maintenance ModeExit Maintenance Mode. Exiting maintenance mode causes the NSX ESX Agent Manager (EAM) to power on the VM-Series firewall. The firewall reboots with the new PAN-OS version.
      8. Migrate (automatically or manually) all VMs back to the original host.
    6. Repeat this process for each VM-Series firewall on each ESXi host.
    7. Verify the software and content release version running on each managed device.
      1. Select PanoramaManaged Devices.
      2. Locate one or more devices and review the content and software versions on the table.

    © 2026 Palo Alto Networks, Inc. All rights reserved.