Upgrade the PAN-OS Software Version (Standalone Version)

Now that the VM-Series firewall has network connectivity and the base PAN-OS software is installed, consider upgrading to the latest version of PAN-OS. Use the following instructions for firewalls that are not deployed in a high availability (HA) configuration. For firewalls deployed in HA, refer to the Upgrade the VM-Series Model in an HA Pair. To minimize downtime for your users, perform upgrades during non-business hours.
  1. Verify that enough hardware resources are available to the VM-Series firewall. Refer to the VM-Series System Requirements to see the resource requirements for each VM-Series model. Allocate additional hardware resources before continuing the upgrade process. The process for assigning additional hardware resources differs on each hypervisor.
  2. From the web interface, navigate to
    Device
    Licenses
    and make sure you have the correct VM-Series firewall license and that the license is activated.
    On the VM-Series firewall standalone version, navigate to
    Device
    Support
    and make sure that you have activated the support license.
  3. (Required for a firewall that is in production) Save a backup of the current configuration file.
    1. Select
      Device
      Setup
      Operations
      and click
      Export named configuration snapshot
      .
    2. Select the XML file that contains your running configuration (for example,
      running-config.xml
      ) and click
      OK
      to export the configuration file.
    3. Save the exported file to a location external to the firewall. You can use this backup to restore the configuration if you have problems with the upgrade.
  4. Check the Release Notes to verify the Content Release version required for the PAN-OS version. The firewalls you plan to upgrade must be running the Content Release version required for the PAN-OS version.
    1. Select
      Device
      Dynamic Updates
      .
    2. Check the
      Applications and Threats
      or
      Applications
      section to determine what update is currently running.
    3. If the firewall is not running the required update or later, click
      Check Now
      to retrieve a list of available updates.
    4. Locate the desired update and click
      Download
      .
    5. After the download completes, click
      Install
      .
  5. Upgrade the PAN-OS version on the VM-Series firewall.
    1. Select
      Device
      Software
      .
    2. Click
      Refresh
      to view the latest software release and also review the
      Release Notes
      to view a description of the changes in a release and to view the migration path to install the software.
    3. Click
      Download
      to retrieve the software then click
      Install
      .
  6. If you are upgrading from a PAN-OS version earlier than 8.0, transition your VM-Series firewall from a 40GB hard disk to a 60GB hard disk.
    1. Shut down the VM.
    2. On your hypervisor, attach a new 60GB hard drive to the VM-Series firewall. This new disk must be 60GB. The firewall will return an error if another value is assigned.
    3. Power on the VM-Series firewall.
    4. Access the firewall CLI.
    5. Use the following CLI command to verify that the new 60GB hard disk has been added. The new hard disk should be called
      sdb
      .
      >
      show system disk-space
    6. Use the following CLI command to create a new disk partition to copy the data from the original system disk to the new system disk.
      >
      request system clone-system-disk target sdb
    7. Return to your hypervisor and power off the VM-Series firewall.
    8. Remove the original system disk.
    9. Power on the VM-Series firewall.

Recommended For You