Upgrading the PAN-OS version or VM-Series model allows
you to add the latest features and fixes that help improve the security
capabilities and performance of your firewalls.
The standard PAN-OS release is just that; the normal version
of PAN-OS that can be installed on all Palo Alto Networks firewalls.
The PAN-OS XFR releases are for VM-Series firewalls only and can
include new features and bug fixes for VM-Series firewalls. If you
install a PAN-OS XFR image on the VM-Series firewalls, the features
and fixes are not available in PAN-OS versions that are earlier
than the software version you have installed.
Because XFR images include features and fixes that are specific
to VM-Series firewalls, if you upgrade to an XFR release, you must
stay on XFR releases to keep XFR specific features until the next
major PAN-OS release; all the fixes and capabilities available in
XFR will be cumulatively rolled into the next major PAN-OS release.
Verify the VM-Series System Requirements for your
firewall model before you upgrade. If your firewall has less than
5.5GB memory, the system capacity (number of sessions, rules, security
zones, address objects, etc) on the firewall will be limited to
that of the VM-50 Lite.