Upgrade to PAN-OS 9.0 XFR

Upgrading the PAN-OS version or VM-Series model allows you to add the latest features and fixes that help improve the security capabilities and performance of your firewalls. Staring with PAN-OS 9.0.3, the VM-Series firewall supports two types of PAN-OS releases—standard PAN-OS release and accelerated feature release (XFR).
The standard PAN-OS release is just that; the normal version of PAN-OS that can be installed on all Palo Alto Networks firewalls. The PAN-OS XFR releases are for VM-Series firewalls only and can include new features and bug fixes for VM-Series firewalls. If you install a PAN-OS XFR image on the VM-Series firewalls, the features and fixes are not available in PAN-OS versions that are earlier than the software version you have installed.
Because XFR images include features and fixes that are specific to VM-Series firewalls, if you upgrade to an XFR release, you must stay on XFR releases to keep XFR specific features until the next major PAN-OS release; all the fixes and capabilities available in XFR will be cumulatively rolled into the next major PAN-OS release.
Before upgrading to PAN-OS 9.0.3 XFR, you must upgrade the VM-Series plugin on your firewalls and Panorama to VM-Series plugin 1.0.5 or later. For more information, see Upgrade the VM-Series Plugin.
When upgrading your VM-Series firewall to a PAN-OS XFR image, you must first upgrade to the base (non-XFR) version of that release. For example, to upgrade from PAN-OS 8.1 to PAN-OS 9.0.3 XFR, you must upgrade your firewall to PAN-OS 9.0.3 and then to PAN-OS 9.0.3 XFR.
To downgrade from an XFR release to an older major PAN-OS release, such as PAN-OS 9.0.3 XFR to PAN-OS 8.1.3, you must first downgrade to the major PAN-OS release that corresponds to the XFR release. For example, to get from PAN-OS 9.0.3 XFR to PAN-OS 8.1.3, you must first downgrade from PAN-OS 9.0.3 XFR to PAN-OS 9.0.0 (non-XFR).

Recommended For You