PAN-OS Upgrade Checklist

Make sure the device is registered and licensed.
Verify the available disk space.
The disk space required varies based on the PAN-OS release. Select
Device
Software
and review the target PAN-OS release
Size
to determine the required disk space.
Run
show system disk-space
Verify the minimum content release version.
Identify the preferred release.
See the Palo Alto Networks Support Software Release Guidance and End-of-Life Summary for more information. Additionally, review the known and addressed issues, upgrade and downgrade considerations, and limitations for your target PAN-OS release to understand how a PAN-OS upgrade may impact you.
Determine the upgrade path.
When you upgrade from one PAN-OS feature release version to a later feature release, you cannot skip the installation of any feature release versions in the path to your target release.
Review the upgrade/downgrade considerations for all releases in your upgrade path.
(
Required for GlobalProtect
) Verify the minimum GlobalProtect™ agent version to prevent GlobalProtect users from losing VPN connectivity. GlobalProtect can be upgraded directly to the latest version.
Verify the minimum plugin release versions on the target release version for any plugins you have installed.
Verify connectivity from the management interface to the update server.
Select
Device
Troubleshooting
and test the
Update Server Connectivity
to check that the DNS can resolve the address.
If it doesn’t resolve, change the DNS to
8.8.8.8
(you need to use a public DNS server rather than your own DNS server) and ping again.
If this doesn’t resolve, change the update server to
staticupdates.paloaltonetworks.com
and
Commit
.
(
SD-WAN only
) Identify the hub and branch firewalls you intend to upgrade to PAN-OS 10.2.
To preserve an accurate status for your SD-WAN links, you must upgrade your hub firewalls to PAN-OS 10.2 before you upgrade your branch firewalls. Upgrading branch firewalls before hub firewalls may result in incorrect monitoring data (
Panorama
SD-WAN
Monitoring
) and for SD-WAN links to erroneously display as
down
.
If there are any plugins currently installed, download the plugin version supported on PAN-OS 10.2 for all plugins currently installed on Panorama (
Panorama
Plugins
) or your firewall (
Device
Plugins
) before upgrade.
See the Panorama Plugins Compatibility Matrix for the Panorama plugin version supported on PAN-OS 10.2.
This is required to successfully upgrade Panorama and firewall from PAN-OS 10.2 to PAN-OS 10.2. The downloaded plugin version is automatically installed during upgrade to PAN-OS 10.2. Upgrade to PAN-OS 10.2 is blocked if the supported plugin version is not downloaded.