Downgrade a Firewall to a Previous Maintenance Release

1. Save a backup of the current configuration file.

   Although the firewall automatically creates a backup of the configuration, it is a best practice to create a backup before you downgrade and store it externally.

   1. Export named configuration snapshot (DeviceSetupOperations).
   2. Select the XML file that contains your running configuration (for example, running-config.xml) and click OK to export the configuration file.
   3. Save the exported file to a location external to the firewall. You can use this backup to restore the configuration if you have problems with the downgrade.
2. Install the previous maintenance release image.

   If your firewall does not have internet access from the management port, you can download the software update from the Palo Alto Networks Support Portal. You can then manually Upload it to your firewall.

   1. Check Now (DeviceSoftware) for available images.

      (PAN-OS 11.0.5 and later 11.0 releases) By default, the preferred releases and the corresponding base releases are displayed. To view the preferred releases only, disable (clear) the Base Releases checkbox.
   2. Locate the version to which you want to downgrade. If the image is not already downloaded, then Download it.
   3. After the download completes, Install the image.
   4. After the installation completes successfully, reboot using one of the following methods:

      • If you are prompted to reboot, click Yes.
      • If you are not prompted to reboot, go to Device Operations (DeviceSetupOperations) and Reboot Device.