Why can't we downgrade the PAN-OS on 7500 to below 11.1.3?

Why can't we downgrade the PAN-OS on 7500 to below 11.1.3?

391
Created On 05/30/25 07:40 AM - Last Modified 10/21/25 20:14 PM


Question


When we attempt to downgrade the software of PA-7500 to the lower versions of PAN-OS 11.1 than 11.1.3, the attempt is failed with the following console log messages.

Error: Downgrade from 11.1.3 to 11.1.2 not allowed, only downgrades to 11.1.3 or greater allowed.

Are there any other ways to downgrade the software running in PA-7500 to the lower versions?



Environment


  • PA-7500
  • PAN-OS 11.1.3 or later
  • Attempt to downgrade the software to the version < 11.1.3


Answer


  1. Beginning with PAN-OS 11.1.3, PA-7500 Series firewalls support an NGFW cluster of two firewalls that provide redundancy in the event of a link failure, card failure, or chassis failure.
  2. This is documented PAN-OS | NGFW Clustering.
  3. So the downgrade is only allowed to version PAN-OS 11.1.3 or greater versions.


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000k9mfKAA&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail