If your PA-220 is managed by Panorama, the Panorama firmware must be equal or higher than the PA-220 firmware. A Panorama on 10.0 cannot manage a PA-220 on 11.0.
If your PA-220 has internet access, you can download directly from the CLI:
request system software download version 10.1.10
This pulls the firmware from updates.paloaltonetworks.com. This requires an auth code in your device configuration.
Palo Alto Networks has announced that the PA-220 hardware is nearing End-of-Sale (EoS). However, the PA-220 firmware will continue to receive security updates under Sustaining Support until the official End-of-Life (EoL) date.
Generate a simple ping across two zones. Then check the traffic log:
show log traffic direction equal backward
Never upgrade a PA-220 directly from a very old version to the newest one. You must step through the recommended upgrade paths.
Example Path (From 9.0 to 10.1):
The Process:
