Always download the "base image" first. Do not confuse this with "PAN-OS virtual router images" or "content updates."