Palo Alto NGFW Training Course

PAN-OS upgradation process depends on whether it’s in high availability (HA) or standalone configuration. In this lesson, we will learn to Upgrade PAN-OS on a Standalone Palo Alto Firewall. So, let’s get started.

Backup:

You should take a backup before up-gradating your firewall. To take backup, you need to go Device >> Setup >> Operations. Now click on Export named configuration snapshot, select running-config.xml from drop-down menu and hit OK.

Palo Alto Networks Firewall Backup Process

Upgrade Path:

You need to download base image on your firewall, before installing maintenance release image. Below are the example of the base image and maintenance release image in Palo Alto.

Base Image: 9.1.0
Maintenance Release Image: 9.1.1

If you go to download Maintenance Release first, you will see below error message from Palo Alto. We were trying to download 9.1.1 before 9.1.0 version.

Software Download Error

IMPORTANT: Before upgrading it’s recommended to check release note.

Software:

You can download software directly on your firewall if you have a Premium Support License and Internet connection for that device. Otherwise, you need to download PAN-OS from https://support.paloaltonetworks.com and upload it manually.

Direct Download on Firewall:
To download directly on your firewall, you need to go Device >> Software and then click on Check Now to see all available PAN-OS images. After that, download your desire base image by clicking Download from Action column of that image. After completing the download of the base image, go for maintenance image release.

Automatic Download

By uploading Pan-OS:
To upload your software, you need to go Device >> Software and click Upload. Now select the file from your local device and click OK. You need to upload both base image and maintenance image.

Manual Upload

Install Software:

In the same location (Device >> Software), click Install on Action column for that particular PAN-OS. In my case, it’s 9.1.1.

How to Upgrade PAN-OS on a Standalone Palo Alto Firewall

It will show a warning sign, hit OK to continue. Now, you will be able to see the progress bar like below.

Install

After completing installation process, it will ask to reboot. You need to hit Yes to continue.

Verification

To verify, go to the Dashboard and check General Information section. It’s clearly showing that, we have successfully upgraded to 9.1.1 version.

Software Version

You also can verify it from Device >> Software page. Hope this will help.

Written by Rajib Kumer Das

I am Rajib Kumer Das, a network engineer with 8+ years of experience in multi-vendor environment. In my current position, I am responsible to take care critical projects and it's support cases. I do have several vendor certificates and have plans to go further.

Leave a Comment

Your email address will not be published. Required fields are marked *