Upgrading to a new version of PanOS but cannot download the OS directly from the update site. Therefore, I manually uploaded the new PanOS. But after the firewall confirmed that the image was successfully updated, it does not display it under the software window list.

This is a known behavior, with two solutions. First solution is to click install from file on the bottom of the software page and it will appear as an installation candidate on the list.

Second solution is to SSH to the firewall and login as an admin. Then run this command to install the newly uploaded PanOS

request system software install version 9.x.x

This will prompt you with a message similar to the one below;

Executing this command will install a new version of software. It will not take effect until the system is restarted. Do you want to continue? (y or n)

type ' y ' to proceed

To track the installation process, run command

show jobs id x

x refers to the job id number that will be provided to you by the system after the software install is queued.

NOTE: If your device has support license but no threat license, use panupv2-all-apps-xxx to update dynamic updates before installing PanOS.

If you could not find the application in CLI  run this command

request content upgrade install file (name of file)

If you encounter issues where it errors out with a validation message '' The device is unable to connect to the Palo Alto Networks update server to confirm that the content you’re trying to install is valid.''

Skip validation using this command and run the command again


request content upgrade install skip-content-validity-check yes file (name of file)

Use this command to track installation progress

show jobs all