When downgrading a firewall from a version that supports full shared optimization to one that does not, the system blocks the downgrade if any shared object count exceeds 30. For example, you cannot downgrade from firewalls running 12.1.x to firewalls running 11.2.x or earlier with more than 30 External Dynamic List (EDL) objects. To proceed, either upgrade the firewall to a preferred release or reduce the shared objects to 30 or fewer.

Specifically, before downgrading from 12.1.x to 11.1.x and earlier releases, you must follow three essential steps.

1. First, reduce shared object configurations to their previous capacity limits. For example, if you have configured 2500 URL objects per vsys in 12.1.2, reduce them to 500.
2. Second, turn off the feature: for a standalone firewall, run the command debug device-server pan-url-db cc-id-type off, while for a Panorama-managed firewall, configure the shared-optimization mode on Panorama to Partial.
3. Third, commit these changes on Panorama and push them to the firewalls to ensure the necessary configuration adjustments are applied.

None

When downgrading from a VM-Series Tier 3/Tier 2 memory profile to a Tier 1 memory profile, you must first de-select Enable IPv6 Geolocation (DeviceSessionsSession Settings) before downgrading, otherwise you will encounter a commit failure.

You must remove the configuration and then uninstall the Network Discovery plugin when downgrading from PAN-OS 12.1.2.

When downgrading Panorama from version 11.2 or 12.1 to 11.1 or earlier, inconsistencies may occur if different IKE versions are configured for the same IKE gateway across one or more templates, and the Overwrite option is used for configuration overrides related to that IKE gateway. This issue doesn't affect IKE gateways where no fields have been overwritten, and doesn't impact NGFW downgrades.

Workaround: After downgrading Panorama, review the IKE gateway configuration across all templates. Ensure that the IKE version is consistent across templates for a specific gateway before pushing configurations to the firewalls.

None

None

Before downgrading a PA-415-5G firewall to a release earlier than PAN-OS 11.2.3 or earlier than PAN-OS 11.1.5, if you have an IPv6 address configured on a cellular interface, configure the interface with an IPv4 address and remove the IPv6 address. Otherwise, the firewall blocks the downgrade.

Before downgrading to a release earlier than PAN-OS 11.1.5, disable NPTv6 on an interface that has a dynamically assigned IPv6 address or remove the configuration. (The downgrade block is unavailable between PAN-OS 11.1.5 and 11.1.0; therefore, the image downgrade succeeds, but auto commit fails.)

If you downgrade to a release that doesn't support IKE gateway with dynamic IPv6 address assignment (a release earlier than PAN-OS 11.1.5), the NGFW disables the IPSec tunnel. You must load a supported configuration to match the PAN-OS version to which you downgraded.

A downgrade attempt to a release earlier than PAN-OS 11.1.4 will be blocked when Duplicate IP Address Support is enabled. An error message will appear upon a downgrade attempt, Failed to downgrade. Duplicate IP address is not supported in older versions. Please remove all duplicate IP address configuration, disable Duplicate IP Address Support, and commit before proceeding with the downgrade.

None

When using Panorama to downgrade the firewall from PAN-OS 11.1.1 to 11.0 0, per policy persistent DIPP NAT rules are converted to regular DIPP NAT rules.

If you downgrade from PAN-OS 11.1 with TLSv1.3 to an earlier PAN-OS version, the TLSv1.3 will be replaced with TLSv1.2 after you downgrade. The downgrade will succeed but auto commit will fail if you had selected TLS v1.3 aes-chacha20-poly1305 cipher, in PAN-OS 11.1 that is not supported in the earlier PAN-OS versions. You must add or replace the appropriate supported ciphers to the downgraded version and commit the changes manually.

None.

None.

None.

None.

None.

Downgrading a next-generation firewall from PAN-OS 11.1 will fail if it has pan service proxy enabled. To downgrade successfully, disable pan service proxy before you downgrade.

Next-Generation firewall: Select NetworkProxy, click the settings icon for Proxy Enablement, choose None, and then click OK.

Panorama: SelectTemplatesNetworkProxy, click the settings icon for Proxy Enablement, choose None, and then click OK.

If you select the Exit the sequence on failed authentication option, downgrading from PAN-OS 11.1.1 to a previous version is not successful unless the Exit the sequence on failed authentication option is not selected or unless both the Exit the sequence on failed authentication option and the Use domain to determine authentication profile option are selected.