Before upgrading firewalls to PAN-OS 11.0, you must first upgrade Panorama to
Dedicated Log Collectors must be running the same or later PAN-OS version than
the managed firewalls forwarding logs.
Panorama running PAN-OS 11.0 can manage WildFire® appliances and WildFire
appliance clusters that are running the same or an earlier PAN-OS release.
See Panorama Management Compatibility for
It is recommended that the Panorama management server, Wildfire appliances, and
Wildfire appliance clusters run the same PAN-OS release.
The content release version on the Panorama management server must be the same
(or earlier) version as the content release version on any Dedicated Log
Collectors or managed firewalls. See Panorama Management Compatibility for
Palo Alto Networks® recommends installing the same Applications database
version on Panorama as on the Dedicated Log Collectors and firewalls.
Regardless whether your subscriptions include the Applications database or
Applications and Threats database, Panorama installs only the Applications
database. Panorama and Dedicated Log Collectors do not enforce policy rules so
they do not need the threat signatures from the Threats database. The
Applications database contains threat metadata (such as threat IDs and names)
that you use on Panorama and Dedicated Log Collectors when defining policy rules
to push to managed firewalls and when interpreting threat information in logs
and reports. However, firewalls require the full Applications and Threats
database to match the identifiers recorded in logs with the corresponding
threat, URL, or application names. Refer to the Release Notes for the minimum content
release version required for a Panorama release.