Review the PAN-OS 7.1 Release Notes and then use the following procedure to upgrade a firewall not in an HA configuration to PAN-OS 7.1.
When upgrading firewalls configured to forward content to a WF-500 appliance, you must first upgrade the WF-500 appliance before upgrading the connected firewalls.
Ensure the devices are connected to a reliable power source. A loss of power during an upgrade can make the devices unusable.
Upgrade PAN-OS
Save a backup of the current configuration file. Although the firewall automatically creates a configuration backup, it is a best practice to create and externally store a backup before you upgrade. Select Device > Setup > Operations and Export named configuration snapshot. Select the XML file that contains your running configuration (for example, running-config.xml) and click OK to export the configuration file. Save the exported file to a location external to the firewall. You can use this backup to restore the configuration if you have problems with the upgrade.
Make sure the firewall is running content release version 564 or later. Select Device > Dynamic Updates. Check the Applications and Threats or Applications section to determine what update is currently running. If the firewall is not running the minimum required update, Check Now to retrieve a list of available updates. Locate and Download the appropriate update. After the download completes, Install the update.
Determine the upgrade path. You cannot skip installation of any major releases in the path to your target PAN-OS version. Therefore, if you intend to upgrade to a version that is more than one major release away, you must still download, install, and reboot the firewall for each intermediate major release along the upgrade path. For example, if you want to upgrade from PAN-OS 6.0.13 to PAN-OS 7.1.1, you must: Download and install PAN-OS 6.1.0 and reboot. Download and install PAN-OS 7.0.1 and reboot (7.0.1 is the base image for the 7.0 release, not 7.0.0). Download and install PAN-OS 7.0.9 or a later PAN-OS 7.0 release and reboot. Download PAN-OS 7.1.0 (you do not need to install it). Download and install PAN-OS 7.1.1 and reboot. Select Device > Software. Check which version has a check mark in the Currently Installed column and proceed as follows: If PAN-OS 7.0.9 or a later release is currently installed, continue to Step 4. If a version earlier than PAN-OS 7.0.9 is currently installed, follow the upgrade path to PAN-OS 7.0.9 or a later PAN-OS 7.0 release before you upgrade to PAN-OS 7.1. Refer to the Release Notes for your currently installed PAN-OS version for upgrade instructions.
Install PAN-OS 7.1. If your firewall does not have Internet access from the management port, you can download the software update from the Palo Alto Networks Support Portal. You can then manually Upload it to your firewall. Check Now for latest updates. Locate and Download the version to which you intend to upgrade. After the download completes, Install the update. After the installation successfully completes, reboot using one of the following methods: If you are prompted to reboot, click Yes. If you are not prompted to reboot, select Device > Setup > Operations and Reboot Device (Device Operations section).
Verify that the firewall is passing traffic. Select Monitor > Session Browser.

Related Documentation