Palo Alto PAN-OS Upgrade Path

Palo Alto NetworksPAN-OSFirewalls & Panorama

Plan a PAN-OS upgrade from your current release to a target. The tool follows Palo Alto's documented upgrade path: from 10.1 onward you can skip up to three feature releases, and below 10.1 every feature release is installed in turn. It only installs releases your firewall model supports, using Palo Alto's compatibility matrix, and it points out per-release gotchas from the Upgrade/Downgrade Considerations, HA-pair rules, and where each release sits in Palo Alto's end-of-life summary. Paste show system info to fill in your version and model.

Paste show system info to fill this in

1 Your device

Firewall

Panorama Upgrade Panorama and its Log Collectors before the firewalls it manages.

Firewall model

Pick your model so the tool only uses releases it supports and can show the rules for your hardware. Leave it on “Not sure” to see the path for the releases alone. The matrix lists some models as a group (for example PA-3200 Series).

This firewall is one of an HA pair HA pairs have extra rules when an upgrade skips feature releases.

2 Your releases

Current release

Target release

Exact current version (optional)

The exact version lets the tool check your model's minimum release and a few version-specific issues.

Official Palo Alto Networks resources: Determine the upgrade path · Upgrade/Downgrade Considerations · Upgrade an HA pair · Supported OS releases by model · End-of-life summary · Upgrade FAQ and release guidance

The upgrade path comes from Palo Alto's “Determine the Upgrade Path” page, per-release rules from the Upgrade/Downgrade Considerations and HA upgrade pages, hardware support from the Palo Alto Networks Compatibility Matrix, and lifecycle dates from the PAN-OS & Panorama table of the End-of-Life Summary. Palo Alto's “preferred” maintenance release for each version is on a customer-only page, so this tool does not name one: look it up with request system software info preferred (11.1.3 and later) or on the Software Release Guidance page. Hardware end-of-life dates are on Palo Alto's separate hardware summary and are not covered here. This tool is independent and is not affiliated with or endorsed by Palo Alto Networks, Inc. PAN-OS and Panorama are trademarks of Palo Alto Networks, Inc.