Panorama, Log Collector, Firewall, and WildFire Version Compatibility
PAN-OS® 8.1 version compatibility for Panorama™, Log
Collectors, firewalls, and WildFire®.
For best results, adhere to the following Panorama™
Install the same Panorama release
on both the Panorama management server and the Dedicated Log Collectors.
Panorama must be running the same or a later PAN-OS version
than the firewall it manages. For example, a Panorama running PAN-OS
9.0 supports management of firewalls running PAN-OS 9.0, 8.1, and
earlier PAN-OS releases.
Before upgrading firewalls to PAN-OS
9.0, you must first upgrade Panorama to 9.0.
6.1 and later versions cannot push configurations to firewalls running
PAN-OS 6.0.0 through PAN-OS 6.0.3.
Panorama running PAN-OS 9.0 can manage WildFire® appliances
and WildFire appliance clusters that are running the same or an
earlier PAN-OS release. For example, a Panorama running PAN-OS 9.0
supports management of WildFire appliances and WildFire appliance
clusters running PAN-OS 9.0, 8.1, and earlier PAN-OS releases.
is recommended that the Panorama management server, Wildfire appliances, and
Wildfire appliance clusters run the same PAN-OS release.
The content release version on the Panorama management server
must be the same (or earlier) version as the content release version
on any Dedicated Log Collectors or managed firewalls.
Palo Alto Networks® recommends installing
the same Applications database version on Panorama as on the Dedicated
Log Collectors and firewalls.
Regardless whether your
subscriptions include the Applications database or Applications
and Threats database, Panorama installs only the Applications database.
Panorama and Dedicated Log Collectors do not enforce policy rules
so they do not need the threat signatures from the Threats database.
The Applications database contains threat metadata (such as threat
IDs and names) that you use on Panorama and Dedicated Log Collectors
when defining policy rules to push to managed firewalls and when
interpreting threat information in logs and reports. However, firewalls
require the full Applications and Threats database to match the
identifiers recorded in logs with the corresponding threat, URL,
or application names. Refer to the Release Notes for the
minimum content release version required for a Panorama release.