The PA-501 is the smallest model in Palo Alto Networks' new PA-500 Series — the entry-level, lowest-cost option in the refreshed branch lineup. I run a pair of them in HA, so here is a real-world look at one thing everyone actually cares about: how long does a PAN-OS upgrade take on it?
Going from PAN-OS 12.1.4-h6 to 12.1.7, one member at a time.
The timeline (elapsed from each reboot command)
| Elapsed | Member 1 | Member 2 |
|---|---|---|
| 0:00 | Reboot command issued | Reboot command issued |
| Ping | +4 min | +3 min |
| Login + online in Panorama | +10 min | +10 min |
| HA initializing | +13 min | +11 min |
| HA up | +15 min | +13 min |
End to end, both members: 30 minutes (first reboot to second member HA up).
What the numbers tell you
Ping back at +3–4 min is just the MGT interface answering ICMP — the management plane is reachable, but not "done." Full mgmt services (web UI / Panorama) are ready at +10 min, and HA finishes the handshake at +13–15 min per member. For the cheapest box in the new series, getting each member through a full version bump and back into HA in about a quarter of an hour is solid.
Config here is lean — 160 security rules, 24 VLANs, 24 zones, a few VPNs and GlobalProtect, well within the PA-501's limits. The autocommit on boot barely registers. The autocommit on boot barely registers, so these times are essentially the platform baseline.
Bottom line
New entry-level PA-501, 12.1.4-h6 → 12.1.7, full HA pair done in 30 minutes. No drama.