Click at the bottom of the page to query the update server. Locate the version you need and click Download . Customer Support Plan - Palo Alto Networks
For the 9.1 train, the preferred release is currently 9.1.17 or 9.1.17-h1 . palo alto 3020 software download
The PA-3020 supports PAN-OS 9.1 as its final software train. Click at the bottom of the page to query the update server