How to manually import and install PAN-OS major upgrade from the CLI
5797
Created On 02/22/23 07:00 AM - Last Modified 08/14/24 06:17 AM
Objective
This document describes the steps to manually import and install PAN-OS major upgrade on a Palo Alto Networks device from the CLI.
Environment
- Next Generation Firewall or Panorama
- Supported PAN-OS
- Upgrade using CLI
Procedure
- Upload base image version from CLI using "scp import software from username@host:path" or "tftp import software from <tftp host> file <path>"
- Load base image through the command “debug swm load-uploaded image <image_name>" (This process may take a long time to complete)
- Verify base image though the command “debug swm list”.
- Upload maintenance release version through CLI using either "scp import software from username@host:path" or "tftp import software from <tftp host> file <Source path>"
- Install maintenance release version through the command "request system software install version <select version>".
- An example of the procedure is given under "Additional information"
Additional Information
- Upload base image version from CLI using either SCP or TFTP.
- If using SCP
admin@PA-3260> scp import software from panw@10.194.52.194:/home/panw/PanOS_3200-11.0.0
PanOS_3200-11.0.0 100% 1037MB 41.4MB/s 00:25
PanOS_3200-11.0.0 saved
- If using TFTP
admin@PA-3260> tftp import software from 10.194.52.194 file PanOS_3200-11.0.0
mode set to octet
Connected to 10.194.52.194 (10.194.52.194), port 69
getting from 10.194.52.194:PanOS_3200-11.0.0 to /opt/pancfg/tmp/sw-images/cli.tmp.j6BmRy [octet]
Received 1087766224 bytes in 612.2 seconds [14213607 bit/s]
- Load base image through the command “debug swm load-uploaded image <image_name>“.
admin@PA-3260> debug swm load-uploaded image PanOS_3200-11.0.0
Decrypting...
Verifying release 11.0.0 integrity...
* * * * * FIPS-CC RPMS verification begins * * * * *
Verifying integrity on release 11.0.0 RPMs in "normal" mode...
FIPS-CC verify: RPMS database verification passed.
* * * * * FIPS-CC RPMS verification ends * * * * *
admin@PA-3260>
- Verify base image though the command “debug swm list”.
admin@PA-3260> debug swm list
Product B Version Built Loaded
--------------------------------------------------------------------------------
panos * 9.1.0 2019-12-12 19:45:23 2020-08-19 16:01:13
...(Output Omitted)...
panos * 11.0.0 2022-11-16 19:40:26 2023-03-21 22:27:00
admin@PA-3260>
- Upload maintenance release version through CLI using either SCP or TFTP
- If Using SCP
admin@PA-3260> scp import software from panw@10.194.52.194:/home/panw/PanOS_3200-11.0.2
PanOS_3200-11.0.2 100% 498MB 41.4MB/s 00:12
PanOS_3200-11.0.2 saved
- If using TFTP
admin@PA-3260> tftp import software from 10.194.52.194 file PanOS_3200-11.0.2
mode set to octet
Connected to 10.194.52.194 (10.194.52.194), port 69
getting from 10.194.52.194:PanOS_3200-11.0.0 to /opt/pancfg/tmp/sw-images/cli.tmp.c7mEye [octet]
Received 522190848 bytes in 308.2 seconds [1694324 bit/s]
- Install maintenance release version through the command "request system software install version <version #>".
admin@PA-3260> request system software install version
10.2.0 10.2.0
.....(output omitted)...
11.0.0 11.0.0
11.0.2. 11.0.2
<value> Upgrade to a software package by version
admin@PA-3260> request system software install version 11.0.2
Executing this command will install a new version of software. It will not take effect until system is restarted. Do you want to continue? (y or n)
Software install job enqueued with jobid 1296. Run 'show jobs id 1296' to monitor its status. Please reboot the device after the installation is done.
1296
Note: Similar article of Importing and installing the software can be found at "How to import and install PAN-OS from CLI" which covers just the major or minor version.