PAN-OS Upgrade Checklist

What do I need to plan my PAN-OS upgrade?
Planning your PAN-OS upgrade can help ensure a smoother transition to a newer version of PAN-OS for your Panorama or firewalls.
  • Make sure the device is registered and licensed.
  • Verify the available disk space.
    The disk space required varies based on the PAN-OS release. Select
    and review the target PAN-OS release
    to determine the required disk space.
    • Run
      show system disk-space
  • Verify the minimum content release version.
  • Identify the preferred release.
    See the Palo Alto Networks Support Software Release Guidance and End-of-Life Summary for more information. Additionally, review the known and addressed issues, upgrade and downgrade considerations, and limitations for your target PAN-OS release to understand how a PAN-OS upgrade may impact you.
  • Determine the upgrade path.
    When you upgrade from one PAN-OS feature release version to a later feature release, you cannot skip the installation of any feature release versions in the path to your target release.
  • Review the upgrade/downgrade considerations for all releases in your upgrade path.
  • (
    Required for GlobalProtect
    ) Verify the minimum GlobalProtect™ agent version to prevent GlobalProtect users from losing VPN connectivity. GlobalProtect can be upgraded directly to the latest version.
  • Verify the minimum plugin release versions on the target release version for any plugins you have installed.
  • Verify connectivity from the management interface to the update server.
    • Select
      and test the
      Update Server Connectivity
      to check that the DNS can resolve the address.
      If it doesn’t resolve, change the DNS to
      (you need to use a public DNS server rather than your own DNS server) and ping again.
      If this doesn’t resolve, change the update server to
  • (
    SD-WAN only
    ) Identify the hub and branch firewalls you intend to upgrade to PAN-OS 10.1.
    To preserve an accurate status for your SD-WAN links, you must upgrade your hub firewalls to PAN-OS 10.1 before you upgrade your branch firewalls. Upgrading branch firewalls before hub firewalls may result in incorrect monitoring data (
    ) and for SD-WAN links to erroneously display as

Recommended For You