PAN-OS End of Life: Standard vs Extended Support Dates

Most PAN-OS end-of-life lists give one date per release, and that date is usually the end of standard support. Palo Alto now runs a second phase after it. Extended Support starts automatically when standard support ends, delivers a narrower set of fixes, and on hardware that cannot run a newer release it lasts until the hardware itself reaches end of life.

The result: three of the most-used releases, PAN-OS 10.2, 11.1 and 11.2, all leave support in 2027, unless the firewall is stuck on that release. This page sets out the real dates per release, the ceiling per model family, the upgrade path, what the lifecycle means for GlobalProtect, and when upgrading stops being the right answer.

PAN-OS end-of-life dates for the releases most in use

PAN-OS 10.2 left standard support on 27 August 2025 and stays in extended support until 31 March 2027. PAN-OS 11.1 and 11.2 leave standard support in May 2027 and extended support on 31 August 2027. The current releases, 12.1 and 12.2, run to 2029 and 2030 including extended support.

The 10.2 date moved recently. Palo Alto updated it on 12 May 2026, from 30 September 2026 to 31 March 2027, and a Palo Alto partner notice cited the upgrade burden on customers as the reason. A date that moved once can move again, but planning on a further extension is not a plan.

The PAN-OS version lifecycle table

Source: Palo Alto Networks End-of-Life Summary.

Palo Alto's own wording on the second phase: Extended Support "begins automatically when Standard Support ends". A support contract is still needed for any software update, in both phases. The scope of extended support is narrower than standard support; sources disagree on the exact threshold, so treat it as a reduced set of fixes rather than full maintenance.

Other firewall vendors run comparable cycles with different names and lengths. The firewall and VPN end-of-life tracker puts those dates next to each other for teams that run more than one brand.

Hardware ceilings per model family

Every Palo Alto model has a last supported PAN-OS release. When a model reaches that ceiling, its last release stays in extended support until the hardware end-of-life date, "even if the general OS EOL date has passed".

Source: Palo Alto Networks Hardware End-of-Life Dates.

Two lines stand out for the mid-market. The PA-800 and PA-3200 cannot go beyond 11.1, so the end of standard support for 11.1 in May 2027 marks the end of new fixes beyond the extended scope for those boxes. And the whole PA-400 range, the usual branch replacement for a PA-220, goes end of sale on 22 March 2027. The PA-220 and PA-800 article covers those two hardware families in detail.

A capped firewall that is due for replacement also has to be retired properly: configuration exported, certificates and VPN keys revoked, licences and support contracts moved or ended. The firewall decommissioning checklist covers those steps.

What is the real last date for my firewall?

The real last date for fixes depends on two things together: the PAN-OS release you run and whether your hardware can run anything newer. On current hardware, the release's own extended-support date applies. On hardware capped at that release, extended support runs until the hardware's end of life.

Three examples show how far apart those dates can be:

• A PA-440 on 10.2. The PA-440 can run up to 12.2, so the general 10.2 date applies: extended support ends on 31 March 2027. Staying on 10.2 is a choice, not a constraint.
• A PA-220 on 10.2. The PA-220 cannot run anything newer, so 10.2 stays in extended support until the PA-220's end of life on 31 January 2028.
• A PA-850 on 11.1. Standard support for 11.1 ends on 3 May 2027; on a PA-850 the release then stays in extended support until 31 August 2029.

To place a firewall on this map you need two facts: the model and the PAN-OS release it runs. Both are visible on each firewall's dashboard and, for managed firewalls, in Panorama, which makes it practical to list the real last date for every firewall in one table before budgets are set.

Search results and AI summaries usually show only the first date per release, which makes 10.2 look finished since August 2025 and makes a PA-850 look safe until 2029. Neither reading is right on its own.

PAN-OS upgrade paths

Since PAN-OS 11.0, firewalls running 10.1 or later can skip up to three releases in one upgrade. Palo Alto's upgrade documentation lists a direct path from 10.2 to 11.2, and from 11.0 or 11.1 directly to 12.1. A firewall on 10.2 that needs to reach 12.1 therefore takes two steps: 10.2 to 11.2, then 11.2 to 12.1.

Each step needs the base image downloaded first, the content updates the target release requires, and an upgrade order for HA pairs. Check the release notes of every release on the path before the change window, because the upgrade-path page has changed over time.

GlobalProtect and remote access

GlobalProtect portals and gateways run inside PAN-OS, so their security depends on the PAN-OS release on the firewall. When the release leaves standard support, the internet-facing VPN gateway gets only the narrower set of extended-support fixes. When extended support ends, that gateway gets none.

The GlobalProtect app has its own lifecycle on top of that. Version 6.2 reaches end of life on 30 June 2027 for Windows, macOS and Linux, and version 6.3 on 30 June 2028. Versions 6.0 and 6.1 already ended on 31 December 2025, with exceptions for FIPS-CC mode and some mobile platforms.

Palo Alto is not the only vendor where remote access on the firewall is under pressure. The SSL VPN timeline per vendor shows how Fortinet, SonicWall and others have removed or restricted their firewall-based VPN options.

For teams that already plan to replace GlobalProtect, the GlobalProtect migration alternatives compare the options.

What an end-of-life release exposes

CISA's catalogue of Known Exploited Vulnerabilities lists nine PAN-OS vulnerabilities added since April 2024, three of them in 2026. These are flaws that attackers used in practice, not theoretical findings.

Source: CISA Known Exploited Vulnerabilities Catalog.

Two of these entries concern the remote-access path directly: CVE-2024-3400 in GlobalProtect and CVE-2026-0257, which lets an attacker establish a VPN connection without valid authentication and has been used in ransomware campaigns. A firewall on a release past its support dates does not receive fixes for the next entry on this list.

The cost of staying

Staying supported on a Palo Alto firewall means a support contract plus the security subscriptions for the features you use. Prices are quote-based, but reseller listings give an idea: on 2 November 2026 a German reseller listed three-year Premium Support renewal for a PA-440 at €826.84 excluding VAT, and five years at €1,378.07 excluding VAT. Threat Prevention and other subscriptions come on top.

The larger cost is time. Every release step on every firewall needs a change window, HA sequencing and testing, and standard support for each release lasts about three years, so the cycle keeps coming back.

When to stop upgrading and move remote access

Keep upgrading PAN-OS when the firewall does work that belongs on site: segmentation between internal networks, inspection of traffic to local servers, site-to-site tunnels. Plan the step to 12.1 or 12.2 on hardware that supports it, and refresh hardware that is capped at 10.2 or 11.1 before its last date.

Stop tying remote access to that cycle when GlobalProtect is the main reason the firewall faces the internet. Remote access through GlobalProtect inherits the firewall's software lifecycle and its CVE history. ZTNA delivered from a European platform takes remote users off that cycle: users reach applications, not the network, and the firewall no longer needs an internet-facing VPN gateway.

The Jimber SASE platform delivers that ZTNA with agentless access and data handled in the EU, and the Prisma Access and Jimber comparison covers how it differs from Palo Alto's own cloud option. Try Free and move a first group of remote users before your next PAN-OS upgrade window.

The case for staying on PAN-OS and GlobalProtect

An experienced Palo Alto administrator would disagree with parts of this, with good reasons.

"Extended support is real support." Palo Alto moved the 10.2 date out by six months, and a PA-220 on 10.2 stays patched until January 2028. True, within the narrower scope of extended support.

"Upgrading is routine." With skip-version upgrades, 10.2 to 12.1 is two maintenance windows on hardware the team knows. Also true, for hardware that can run 12.1. For a PA-220, PA-800 or PA-3200 the path ends at 10.2 or 11.1.

"GlobalProtect is tightly integrated with User-ID and HIP checks." Correct, and moving remote access means rebuilding those policies in another platform. The trade-off is an internet-facing gateway on the firewall that has appeared in the exploited-vulnerability catalogue twice since 2024.

Conclusion

PAN-OS 10.2 support ends on 31 March 2027, 11.1 and 11.2 on 31 August 2027, unless your hardware is capped at that release, in which case extended support runs until the hardware's end of life. Check your release and your model together, plan the step to 12.1 or 12.2 where the hardware allows it, and refresh capped hardware before its last date.

If GlobalProtect is the reason the firewall faces the internet, decide on remote access before the next upgrade cycle. Try Free to test ZTNA alongside your Palo Alto firewall, or book a demo to plan the move.

Frequently asked questions

When does PAN-OS 10.2 reach end of life?

Standard support for PAN-OS 10.2 ended on 27 August 2025. Extended support, with a narrower set of fixes, runs until 31 March 2027, after Palo Alto moved the date from 30 September 2026. On hardware that cannot run a newer release, such as the PA-220, 10.2 stays supported until the hardware's end of life.

When does PAN-OS 11.1 reach end of life?

Standard support for PAN-OS 11.1 ends on 3 May 2027 and extended support on 31 August 2027. PA-800 and PA-3200 firewalls cannot go beyond 11.1, so on those models 11.1 stays in extended support until the hardware end of life: 31 August 2029 for the PA-800 and 31 August 2028 for the PA-3200.

What is the difference between standard and extended support?

Standard support covers a PAN-OS release with full maintenance and fixes. Extended support starts automatically when standard support ends and delivers a narrower set of fixes until its own end date. A support contract is still required for software updates in both phases.

Which PAN-OS version should I run in 2027?

On current hardware, PAN-OS 12.1 (standard support until 28 August 2028) or 12.2 (until 30 July 2029). From 10.2 the documented path is to upgrade to 11.2 first, then to 12.1. Hardware capped at 10.2 or 11.1 cannot follow and needs a refresh plan.

Can a PA-220 run PAN-OS 11?

No. The PA-220's last supported release is PAN-OS 10.2, which stays in extended support until the hardware's end of life on 31 January 2028. Palo Alto names the PA-400 and PA-500 series as replacements, and the PA-400 series itself goes end of sale on 22 March 2027.

Does my firewall stop working when PAN-OS reaches end of life?

No. The firewall keeps running. What stops is maintenance: after standard support only a narrower set of fixes arrives, and after extended support none. New vulnerabilities in the firewall or in GlobalProtect then stay open.

Can I upgrade from PAN-OS 10.2 directly to 12.1?

Not in one step according to Palo Alto's upgrade-path documentation. Since PAN-OS 11.0, firewalls can skip up to three releases, which allows 10.2 to 11.2 directly, and 11.2 to 12.1 in a second step.

When does the GlobalProtect app reach end of life?

GlobalProtect 6.2 reaches end of life on 30 June 2027 and 6.3 on 30 June 2028. Versions 6.0 and 6.1 already ended on 31 December 2025, with later dates only for FIPS-CC mode and some mobile platforms.

Which models replace the PA-800?

Palo Alto names the PA-1400 series as the replacement for the PA-800 series. The PA-820 and PA-850 went end of sale on 31 August 2024 and reach hardware end of life on 31 August 2029.