When complete, click on Download (5) on version 9.1.4, then install (option will be available once the image has downloaded). When complete, click on Download (4) for base image 9.1.0:
Alternatively, they can be downloaded from then upload it manually.įrom the GUI, go to Device > Software, then click on Check Now (3) to update the software list. Newer PAN-OS versions can be downloaded directly from the firewall GUI (recommended). As explained previously, for this process, we will download base 9.1.0 and then download & install maintenance release 9.1.4. We will be upgrading our firewall from PAN-OS 9.0.3-h3 to 9.1.4. Once the backup is complete, it is highly recommend to export the configuration by selecting Export named configuration snapshot (5) and saving it in a safe place. To create a backup go to Devices > Setup, then select the Operations (3) tab and Save named configuration snapshot (4): It is imperative to backup and export the configuration before attempting to upgrade. Once downloaded, we can proceed with the download and installation of version 9.1.4.īacking Up & Exporting Firewall Configuration When attempting to download version 9.1.4, a maintenance release for base 9.1.0, we received an error (see screenshot below) explaining that we need to download 9.1.0 base image first (no installation required).
When upgrading your PAN-OS to the latest maintenance release of a newer base release, the firewall will likely require you to download the new base release before allowing you to install its latest maintenance release.įor example, our firewall is currently running version 9.0.3-h3, noted by the ‘ tick’ on the Currently Installed column, and our goal is to upgrade to version 9.1.4 (preferred release) as shown below: Maintenance releases are small upgrades of the base image and deal with bug fixes and sometimes introduce small enhancements.Īs a rule of thumb, firewalls should be running the Palo Alto preferred PAN-OS release, and it is generally a good practice to install these releases as they are published. Like most vendors, Palo Alto Networks produce a base image and maintenance releases. This ensures the device’s configuration is migrated to the PAN-OS's newer supported features and that nothing “breaks” during the upgrade process. When upgrading from a fairly old to a newer PAN-OS version, multi-step upgrades might be necessary. Understanding PAN-OS Upgrade Pathsĭirect (one-step) upgrade to the latest PAN-OS depends on the current version your firewall is running.
Our article How to Register and Activate Palo Alto Support, Subscription Servers, and Licenses covers this process in great detail. It is important to note that only eligible Palo Alto customers, that is, those with an active contract, can receive updates for their firewalls.
Dealing with Common Install Errors: Upgrading Requires Greater Content Version.
Downloading & Installing PAN-OS Software.Backing Up & Exporting Firewall Configuration.When upgrading PAN-OS for both Panorama and Firewall appliances, always upgrade Panorama first. While the same process described below can be used to upgrade Panorama PAN-OS, it is important to ensure the Panorama PAN-OS version is equal or greater than the firewalls. Finally, we will explain why newer PAN-OS releases might not be visible for download in your firewall’s software section. We’ll also explain the PAN-OS upgrade paths, show how to backup and export your configuration, deal with common PAN-OS install errors ( upgrading requires greater content version). This article will show you how to upgrade your standalone Firewall PAN-OS, explain the differences between a Base Image and a Maintenance Release Image. Upgrading your Palo Alto Firewall or Panorama Management System to the preferred PAN-OS release is always recommended as it ensures it remains stable, safe from known vulnerabilities and exploits but also allows you to take advantage of new features.