Planning your PAN-OS upgrade can help
ensure a smoother transition to a newer version of PAN-OS for your
Panorama or firewalls.
Make sure the device is registered
and licensed.
Verify the available disk space.
The disk space required
varies based on the PAN-OS release. Select
Device
Software
and review the target
PAN-OS release
Size
to determine the required disk
space.
Run
show system disk-space
Verify the minimum content release version.
Identify the preferred release.
See the Palo Alto Networks Support Software
Release Guidance and End-of-Life Summary for
more information. Additionally, review the known and addressed issues,
upgrade and downgrade considerations, and limitations for your target PAN-OS
release to understand how a PAN-OS upgrade may impact you.
Determine the upgrade path.
When you upgrade
from one PAN-OS feature release version to a later feature release,
you cannot skip the installation of any feature release versions in
the path to your target release.
Review the upgrade/downgrade considerations for all releases
in your upgrade path.
(
Required for GlobalProtect
) Verify the minimum
GlobalProtect™ agent version to prevent GlobalProtect users from
losing VPN connectivity. GlobalProtect can be upgraded directly
to the latest version.
Verify the minimum plugin release versions on the target
release version for any plugins you have installed.
Verify connectivity from the management interface to the
update server.
Select
Device
Troubleshooting
and
test the
Update Server Connectivity
to check
that the DNS can resolve the address.
If it doesn’t resolve,
change the DNS to
8.8.8.8
(you need to use
a public DNS server rather than your own DNS server) and ping again.
If
this doesn’t resolve, change the update server to
staticupdates.paloaltonetworks.com
and
Commit
.
(
SD-WAN only
) Identify the hub and branch firewalls
you intend to upgrade to PAN-OS 10.2.
To preserve an accurate
status for your SD-WAN links, you must upgrade your hub firewalls
to PAN-OS 10.2 before you upgrade your branch firewalls. Upgrading
branch firewalls before hub firewalls may result in incorrect monitoring
data (
Panorama
SD-WAN
Monitoring
) and for SD-WAN
links to erroneously display as
down
.
If there are any plugins currently installed, download the
plugin version supported on PAN-OS 10.2 for all plugins currently
installed on Panorama (
This is required to successfully upgrade Panorama and
firewall from PAN-OS 10.2 to PAN-OS 10.2. The downloaded plugin
version is automatically installed during upgrade to PAN-OS 10.2.
Upgrade to PAN-OS 10.2 is blocked if the supported plugin version
is not downloaded.