Cloud NGFW Procurement and Management with Software NGFW Credits

Table of Contents

Software NGFW Credit Distribution and Management

Cloud NGFW Procurement and Management with legacy Cloud NGFW Credits

Cloud NGFW Procurement and Management with Software NGFW Credits

Interchange and allocate credits among your Cloud NGFW resources regardless of the Cloud deployment method.

You can procure and associate Software NGFW credits to your Cloud NGFW AWS and Azure tenants by paying an upfront cost for a long-term contract between one and five years. You can procure these credits directly from Palo Alto Networks or its partners. Your Palo Alto Networks sales team and its partners can send these credits to you directly or by using the Cloud provider marketplace Private Offers. These private offers (a.k.a AWS Private Offers, AWS Consulting Partner Private Offers, Azure Private Offers, or Azure Multiparty Private Offers) allow you to take advantage of Cloud Marketplace benefits such as consolidated billing, and their spend commitments (AWS EDP and Azure MACC).

Consider the following when using Software NGFW credits with Cloud NGFW services:

Software NGFW credits are term-based. Terms can be defined for any amount of time between one and five years. Both allocated and unallocated credits expire at the end of the agreed-upon term.
If your monthly average consumption exceeds the purchased credits, additional usage/overage charges are charged at PAYG rates.
If you add Software NGFW credits during a free-trial period, your contract starts immediately and overrides the free trial.
Use the Cloud NGFW for AWS pricing estimator to help you determine AWS pricing for your Cloud NGFW tenant.
You can procure credits for Cloud NGFW and all the CDSS services you intend to use for Cloud NGFW.

You must first subscribe to the Cloud NGFW through AWS Marketplace and create a tenant prior to setting up your deployment profile.

Activate Software NGFW Credits

Once you book the order for credits, they become active immediately, and an email is sent to enable you to start using your credits; for example, if you purchased credits for a one year term on September 6, 2026, the credits are active from that day forward, while the term lasts, in the case of this example, until September 5, 2027. The person listed as the administrative contact in the quote receives the activation email. The email provides details about the subscription, the credit pool ID, the subscription start and end date, the number of credits purchased, and the description of the default credit pool. You can use these details to activate credits in your Customer Support Portal (CSP) account.

Palo Alto Networks recommends retaining this email to access information related to your account.

You will select one of your CSP accounts for the credit pool during activation. Once your credit pool is active, you can manage and allocate the credits to your Cloud NGFW tenants using the Credit Management Application described below.

In the email, click Start Activation to view your available credit pools.
Select the credit pool you want to activate. Use the search field to filter your account list by name or number. If you've purchased multiple credit pools, they will be automatically selected by default. Check marks indicate which pools are eligible for activation and onboarding.

When proceeding, you'll be prompted to sign in or authenticate.

If you deselect a credit pool, a reminder appears letting you know that you’ll need to return to activate it later.

If you're an existing superuser or admin, the Credit Admin role is automatically added to your profile.

If you're new to the Customer Support Portal, an account is created for you with the Credit Admin role assigned.
Select Start Activation.
Select your support account (you can search by account number or name).

You can create multiple accounts within your organization.

When activating your credits, you must select one account per default credit pool.
Select the default credit pool.
Select Deposit Credits.

A message indicates that the deposit was successful.
Once activated, Credit Admins can:
- Allocate credits to specific your deployments
- Transfer credits to other pools if needed
Create and Associate a Deployment Profile.

Associate Software NGFW Credits

Do the following:

Step 1: Create a Parent Deployment Profile in Customer Support Portal
Step 2: Create a Child Parent Deployment Profile in Credit Management Application

Step 1: Create a Parent Deployment Profile (CSP)

Log in to your Palo Alto Networks Customer Support Portal (CSP).
In the left navigation menu, expand Products and select Software/Cloud NGFW Credits.
Click Create New Profile.
Provide a descriptive name, select your target unified pool SKU, and specify CNGFW as the primary service type.
Enter your desired credit capacity and click Submit.

The global unallocated support balance will show a reduction equal to your input amount plus the 18% support overhead block.
Copy the automatically generated DP Authorization Code (AuthCode) from the profile grid for confirmation tracking.
Click Create Deployment Profile.

Step 2: Configure a Child Deployment Profile on Credit Management System (CMS Hub App)

Log into the CMS Hub App.
The dashboard automatically fetches your updated unallocated details from backend IT microservices. Verify that you see a credit pool container matching your CSP configuration, labeled with your explicit DP AuthCode.
Click Create Deployment Profile on the target credit pool row.
Select Amazon Web Services (AWS) as your cloud infrastructure provider.
Enter the target AWS Tenant ID string and assign a specific credit allocation limit to this tenant.
Check or uncheck the Enable Smart Credit Buffer box depending on your overage preferences.
During Deployment Profile setup or modification in CMS, the Enable Smart Credit Buffer checkbox controls buffer access rules:
Enable Smart Credit Buffer (Default): If an overage occurs, the tenant automatically draws from the central unallocated credit buffer. If the buffer has a sufficient balance, it covers the entire overage, resulting in zero direct marketplace PAYG charges for that billing period.
Enable Smart Credit Buffer Disabled: If you want to enforce strict budgetary isolation for an individual environment (such as an isolated lab or testing tenant), you can disable the buffer. If consumption breaches the assigned limit, the system bypasses the unallocated pool entirely and routes the overage directly to AWS Marketplace PAYG billing.
If multiple active AWS tenants exceed their allocated budgets in the same hour, the system satisfies requests using a first-come, first-served strategy based on when each billing microservice reaches the validation step. If the total shared overage exceeds the available buffer, any remaining uncovered consumption overflows to standard marketplace PAYG tracking.
Click Save.