Panorama, Log Collector, Firewall, and WildFire Version Compatibility

• Install the same Panorama release on both the Panorama management server and the Dedicated Log Collectors.
• Panorama must be running the same or a later PAN-OS version than the firewall it manages. See Panorama Management Compatibility for more information.
  Before upgrading firewalls to PAN-OS 9.1, you must first upgrade Panorama to 9.1.
  Panorama 6.1 and later versions cannot push configurations to firewalls running PAN-OS 6.0.0 through PAN-OS 6.0.3.
• Dedicated Log Collectors must be running the same or later PAN-OS version than the managed firewalls forwarding logs.
• Panorama running PAN-OS 9.1 can manage WildFire® appliances and WildFire appliance clusters that are running the same or an earlier PAN-OS release. See Panorama Management Compatibility for more information.
  It is recommended that the Panorama management server, Wildfire appliances, and Wildfire appliance clusters run the same PAN-OS release.
• The content release version on the Panorama management server must be the same (or earlier) version as the content release version on any Dedicated Log Collectors or managed firewalls. See Panorama Management Compatibility for more information.
  Palo Alto Networks® recommends installing the same Applications database version on Panorama as on the Dedicated Log Collectors and firewalls.
  Regardless whether your subscriptions include the Applications database or Applications and Threats database, Panorama installs only the Applications database. Panorama and Dedicated Log Collectors do not enforce policy rules so they do not need the threat signatures from the Threats database. The Applications database contains threat metadata (such as threat IDs and names) that you use on Panorama and Dedicated Log Collectors when defining policy rules to push to managed firewalls and when interpreting threat information in logs and reports. However, firewalls require the full Applications and Threats database to match the identifiers recorded in logs with the corresponding threat, URL, or application names. Refer to the Release Notes for the minimum content release version required for a Panorama release.