Upgrading the PAN-OS version or VM-Series model allows
you to add the latest features and fixes that help improve the security
capabilities and performance of your firewalls. Staring with PAN-OS
9.0.3, the VM-Series firewall supports two types of PAN-OS releases—standard
PAN-OS release and accelerated feature release (XFR).
The standard PAN-OS release is just that; the normal version
of PAN-OS that can be installed on all Palo Alto Networks firewalls.
The PAN-OS XFR releases are for VM-Series firewalls only and can
include new features and bug fixes for VM-Series firewalls. If you
install a PAN-OS XFR image on the VM-Series firewalls, the features
and fixes are not available in PAN-OS versions that are earlier
than the software version you have installed.
Because XFR images include features and fixes that are specific
to VM-Series firewalls, if you upgrade to an XFR release, you must
stay on XFR releases to keep XFR specific features until the next
major PAN-OS release; all the fixes and capabilities available in
XFR will be cumulatively rolled into the next major PAN-OS release.
Before upgrading to PAN-OS 9.0.3 XFR, you must upgrade the VM-Series plugin
on your firewalls and Panorama to VM-Series plugin 1.0.5 or later.
For more information, see Upgrade the VM-Series Plugin.
When upgrading your VM-Series firewall to a PAN-OS XFR image,
you must first upgrade to the base (non-XFR) version of that release.
For example, to upgrade from PAN-OS 8.1 to PAN-OS 9.0.3 XFR, you
must upgrade your firewall to PAN-OS 9.0.3 and then to PAN-OS 9.0.3
To downgrade from an XFR release to an older major PAN-OS release,
such as PAN-OS 9.0.3 XFR to PAN-OS 8.1.3, you must first downgrade
to the major PAN-OS release that corresponds to the XFR release.
For example, to get from PAN-OS 9.0.3 XFR to PAN-OS 8.1.3, you must
first downgrade from PAN-OS 9.0.3 XFR to PAN-OS 9.0.0 (non-XFR).