CN-Series firewall licensing is managed by the Kubernetes plugin on Panorama. The CN-Series firewalls are licensed based on the total number of vCPUs (cores) used by the CN-NGFW, CN-GW, and CN-DB pods deployed in your Kubernetes environment. One token is consumed for each vCPU used by these pods.