PAN-OS release plan

Happy New Year 2026.

It has been some time I wanted to write that post about the PAN-OS software release strategy.

Until PAN-OS 10.2

Each supported PAN-OS version released a maintenance release every 2-3 months.

And unless, there was some critical bug passing through QA tests, there was not so many hotfix releases.

To illustrate that, you can check the number of bug fixed in the releases for PAN-OS 9.1.

["version","Nb fixes"], ['9.1.0', 8],

['9.1.1', 21],

['9.1.2', 89],

['9.1.3', 130],

['9.1.4', 72],

['9.1.5', 96],

['9.1.6', 69],

['9.1.7', 60],

['9.1.8', 74],

['9.1.9', 56],

['9.1.10', 110],

['9.1.11', 104],

['9.1.12', 90],

['9.1.13', 36],

['9.1.14', 26],

['9.1.15', 38],

['9.1.16', 50],

['9.1.17', 20],

['9.1.18', 12],

['9.1.19', 3],

In the list above (dumped from the release notes I saved for PAN-OS 9.1), I ignored the hotfix releases.
But you can see each maintenance release received more than 50 fixes until 9.1.13 then it decreased to be less than 50 fixes.
--> if you are still on PAN-OS 9.1, you can consider than after 9.1.13, the version is quite mature now as there are less software issues addressed.

So what has changed since PAN-OS 10.2?

"Service pack" release

["version","Nb fixes"], ['11.1.0', 11],

['11.1.1', 12],

['11.1.2', 16],

['11.1.3', 130],

['11.1.4', 17],

['11.1.5', 312],

['11.1.6', 52],

['11.1.7', 25],

['11.1.8', 246],

['11.1.9', 53],

['11.1.10', 29],

['11.1.11', 247],

['11.1.12', 41],

['11.1.13', 34],

This is the list of the regular maintenance releases.

If you look carefully the number of fixes. You can noticed there are some "service pack" releases : 11.1.5 with 312 fixes, 11.1.8 with 246 fixes and 11.1.11 with 247 fixes. While the other maintenance releases contain up to 50 fixes.

More Hotfix releases

["version","Nb fixes"], ['11.1.0-h1', 1],

['11.1.2-h1', 4],

['11.1.2-h3', 1],

['11.1.3-h1', 2],

['11.1.4-h1', 9],

['11.1.4-h4', 56],

['11.1.4-h9', 47],

['11.1.4-h13', 69],

['11.1.4-h15', 12],

['11.1.4-h16', 1],

['11.1.4-h17', 23],

['11.1.4-h18', 7],

['11.1.4-h25', 14],

['11.1.4-h27', 6],

['11.1.5-h1', 1],

['11.1.6-h1', 61],

['11.1.6-h3', 12],

['11.1.6-h4', 16],

['11.1.6-h5', 1],

['11.1.6-h6', 33],

['11.1.6-h7', 22],

['11.1.6-h10', 48],

['11.1.6-h14', 66],

['11.1.6-h17', 55],

['11.1.6-h19', 17],

['11.1.6-h20', 15],

['11.1.6-h21', 10],

['11.1.6-h22', 1],

['11.1.6-h23', 24],

['11.1.7-h1', 1],

['11.1.7-h2', 137],

['11.1.10-h1', 57],

['11.1.10-h4', 70],

['11.1.10-h5', 27],

['11.1.10-h7', 65],

['11.1.10-h9', 1],

['11.1.10-h10', 32],

With the new release plan, there is also more hotfix releases now.

Keep in mind the PAN-OS releases are still cumulative: 11.1.8 contains all the issues resolved since 11.1.0 until 11.1.8.

Home PA-450 upgraded to PAN-OS 11.2

My home PA-450 was running on PAN-OS 11.1 since I received it.

Now that PAN-OS 11.2 has reached its 11th release (11.2.0 is the first one, as the date of writing, the last release available is 11.2.10), I think it was time for me to do the move to PAN-OS 11.2.

Among the list of the new features introduced in PAN-OS 11.2, not much for my use case (internet gateway), but I made sure to enable the inline ML inspection.

So far, so good (less than 24h uptime), I am posting this post behind my firewall :)

Palo Alto Networks Network Security Architect ... Passed

Palo Alto Networks has reworked their certification program to be more "role" based.

You can find all the new certifications here.

So you have a track for each main Palo Alto Networks products portfolio:
- Security Operation oriented with Cortex products

- Cloud Security oriented with Prisma Cloud products

- Network Security oriented with Strata products

I took the NetSec NGFW Engineer and the NetSec Analyst, which were more or less covering the PCNSE (Palo Alto Networks certified Networks Security Engineer) earlier this year.

So I wanted to test the NetSec Architect exam, released last October (announcement here).

... and I got a PASS.

Although during the exam, I was not confident until the last question.

This exam is totally different than the NetSec NGFW Engineer and Analyst, it is more "design" oriented in my opinion. Also, a simple NGFW day to day job would not be enough: an understanding of the big picture of the SASE architecture, and how every product fits into this architecture is required.

For the preparation ... just my day to day work in TAC, which let's me honest lack of Prisma Access / Prisma SDWAN experience. 

Positive point: I attended a workshop on Prisma AIRS - runtime protection, the exam requires the candidate to understand the use case of Prisma AIRS vs AI Access, and it helped me in the exam.

Anyway, if I have to prepare it correctly, I would say you need a correct understanding of the different technologies involved in SASE.