Upgrade a ZTP Firewall

Log in to the Panorama Web Interface as an admin user.
Add a ZTP Firewall to Panorama.
Select
Panorama
Device Deployment
Updates
and
Check Now
for the latest PAN-OS releases.
Select
Panorama
Managed Devices
Summary
and select one or more ZTP firewalls.
Reassociate
the selected ZTP firewall(s).
Check (enable)
Auto Push on 1st Connect
.
In the
To SW Version
column, select the target PAN-OS version for the ZTP firewall.
Click
OK
to save your configuration changes.

Select
Commit
and
Commit to Panorama
.
Power on the ZTP firewall.
When the ZTP firewall connects to Panorama for the first time, it automatically upgrades to the PAN-OS version you selected.
Panorama running PAN-OS 11.0.0
—If you are upgrading managed firewalls across PAN-OS major or maintenance releases, the intermediary PAN-OS releases on your upgrade path are installed first before the target PAN-OS release is installed.
For example, you configured the target
To SW Version
for the managed firewall as PAN-OS 11.0.0 and the firewall is running PAN-OS 10.1. On first connection to Panorama, PAN-OS 10.2.0 is installed on the managed firewall first. After PAN-OS 10.2.0 successfully installs, the firewall is automatically upgraded to the target PAN-OS 11.0.0 release.
Panorama running PAN-OS 11.0.1 and later releases
—If you are upgrading managed firewalls across PAN-OS major or maintenance releases, the intermediary PAN-OS major releases on your upgrade path are installed and the base PAN-OS major release is downloaded before the target PAN-OS maintenance release is installed.
For example, you configured the target
To SW Version
for the managed firewall as PAN-OS 11.0.1 and the firewall is running PAN-OS 10.0. On first connection to Panorama, PAN-OS 10.1.0 and PAN-OS 10.2.0 are installed on the managed firewall. After the managed firewall reboots, PAN-OS 11.0.0 is downloaded and then the firewall automatically installs to the target PAN-OS 11.0.1 release.
Verify the ZTP firewall software upgrade.
Log in to the Panorama Web Interface.
Select
Panorama
Managed Devices
Summary
and navigate to the ZTP firewall(s).
Verify the
Software Version
column displays the correct target PAN-OS release.
For all future PAN-OS upgrades, see Upgrade the Firewall to PAN-OS 11.0 from Panorama.