Upgrade a Firewall to PAN-OS 8.0

Review the PAN-OS 8.0 Release Notes and then use the following procedure to upgrade a firewall not in an HA configuration to PAN-OS 8.0.
When upgrading a firewall configured to forward content to a WF-500 appliance, you must first upgrade the WildFire appliance to PAN-OS 8.0 before you upgrade the connected firewall.
Ensure the firewall is connected to a reliable power source. A loss of power during an upgrade can make the firewall unusable.
  1. Save a backup of the current configuration file.
    Although the firewall automatically creates a configuration backup, it is a best practice to create and externally store a backup before you upgrade.
    1. Export named configuration snapshot (DeviceSetupOperations).
    2. Select the XML file that contains your running configuration (for example, running-config.xml) and click OK to export the configuration file.
    3. Save the exported file to a location external to the firewall. You can use this backup to restore the configuration if you have problems with the upgrade.
  2. Ensure that the firewall is running the latest content release versions. Refer to the Release Notes for the minimum content release version you must install for a PAN-OS 8.0 release.
    If your firewall does not have internet access from the management port, you can download the software update from the Palo Alto Networks Support Portal . You can then manually Upload the image(s) to your firewall.
    1. Check the Applications or Applications and Threats (DeviceDynamic Updates) to determine which update is currently running.
    2. If the firewall is not running the minimum required update or a later version, Check Now to retrieve a list of available updates.
    3. Locate and Download the content release version you intend to install. After you successfully download a content update file, the link in the Action column changes from Download to Install for that release version.
    4. Install the update.
      As a best practice, schedule the firewall to download and install the latest content updates as they are made available.
  3. Determine the upgrade path.
    You cannot skip installation of any major release versions in the path to your target PAN-OS release. For example, if you intend to upgrade from PAN-OS 6.1.13 to PAN-OS 8.0.2, you must:
    • Download and install PAN-OS 7.0.1 and reboot (7.0.1 is the base image for the 7.0 release; not 7.0.0).
    • Download and install PAN-OS 7.1.0 and reboot.
    • Download PAN-OS 8.0.0.
    • (Recommended) Install the 8.0 base image and reboot before you install the target maintenance release.
    • Download and install PAN-OS 8.0.2 and reboot.
    Check which version has a check mark in the Currently Installed column (DeviceSoftware) and proceed as follows:
    • If a PAN-OS 7.1 release is currently installed, skip ahead to Step 5 to upgrade the firewall to a PAN-OS 8.0 release.
    • If the firewall is running a release earlier than PAN-OS 7.1, proceed to Step 4 and follow the upgrade path to PAN-OS 7.1.0 before you upgrade to a PAN-OS 8.0 release.
    We highly recommend that you review the known issues and changes to default behavior in the Release Notes and upgrade/downgrade considerations in the New Features Guide for each release through which you pass as part of your upgrade path.
  4. Use the upgrade path identified in previous step to upgrade the firewall to a PAN-OS 7.1 release.
    Repeat the following procedure until the firewall is running a PAN-OS 7.1 release—do not skip installation of any major release version in the path to your target PAN-OS 8.0 release.
    1. Check Now (DeviceSoftware) for the latest updates. If an update is available, the Action column displays a Download link.
    2. For each release in your upgrade path, Download the firewall-specific file for the release version to which you are upgrading. For example, to upgrade a PA-200 firewall to PAN-OS 7.1.0, download the PanOS_200-7.1.0 image; to upgrade a PA-3050 firewall to PAN-OS 7.1.0, download the PanOS_3000-7.1.0 image.
      After a successful download, the Action column changes from Download to Install for that image.
    3. Install the software update on the firewall, select Reboot device after install, and click OK.
    4. After the firewall reboots:
      • If the firewall is then running a PAN-OS 7.1 release, continue to Step 5 .
      • If the firewall is still running a release earlier than PAN-OS 7.1, repeat this step (Step 4 ) for each release in the upgrade path to PAN-OS 7.1.
  5. Install PAN-OS 8.0.
    If your firewall does not have internet access from the management port, you can download the software image from the Palo Alto Networks Support Portal and then manually Upload it to your firewall.
    1. Check Now (DeviceSoftware) for the latest updates.
    2. Locate and Download the version to which you intend to upgrade. If you are upgrading to a PAN-OS 8.0 maintenance release (a release other than the PAN-OS 8.0.0 base image), you must first download the PAN-OS 8.0.0 release.
    3. (Optional only for base-image installation when upgrading to a maintenance release and only when downloading the software image directly from the updates server; for manual uploads, you must install the base image) After you download the image (or, for a manual upgrade, after you upload the image), Install the image.
      For manual upgrades, you must install the base image after you download it and before you upload and install the maintenance release image.
      As a best practice, when upgrading to a PAN-OS 8.0 release, install the PAN-OS 8.0.0 base image and reboot the firewall before you download and install a PAN-OS 8.0 maintenance release.
    4. (Optional only for base-image installation when upgrading to a maintenance release) After the installation completes successfully, reboot using one of the following methods:
      • If you are prompted to reboot, click Yes.
      • If you are not prompted to reboot, go to Device Operations (DeviceSetupOperations) and Reboot Device.
    5. If upgrading to a PAN-OS 8.0 maintenance release, such as PAN-OS 8.0.2, repeat these steps (a through d) to upgrade the firewall to the maintenance release.
  6. Verify that the firewall is passing traffic.
    Select MonitorSession Browser.

Related Documentation