>
    Strata Copilot
    Migrate a Firewall to a Flexible VM-Series License
    Focus
    Download PDF
    Focus
    1. Home
    2. VM-Series
    3. Software NGFW Credits
    4. Migrate a Firewall to a Flexible VM-Series License
    Download PDF
    VM-Series

    Migrate a Firewall to a Flexible VM-Series License

    Table of Contents

    Migrate a Firewall to a Flexible VM-Series License

    Migrate from a model-based license to flexible Software Next Generation firewall credits.
    Where Can I Use This?What Do I Need?
    • VM-Series deployment
    • VM-Series 10.x or above
    • Panorama running PAN-OS 10.1.x or above versions
    • Customer Support Portal (CSP) account with one of the following user roles:
      • Super User, Standard User, Limited User, Threat Researcher, AutoFocus Trial Role, Group Super User, Group Standard User, Group Limited User, Group Threat Researcher, Authorized Support Center (ASC) User, and ASC Full Service User.
      • Superuser access to the VM-Series firewall
    You can migrate your VM-Series firewall perpetual or ELA license to a flexible VM-Series firewall license (funded using Software NGFW credits).
    When you migrate from a perpetual or ELA license, you might need to reboot your firewall to complete the migration. In a fixed vCPU deployment profile, the firewall consumes credits based upon the VM-Series model. After migrating to a deployment profile with fixed vCPUs, each firewall keeps its serial number and does not require a reboot. In a deployment profile with flexible vCPUs, the firewall consumes credits based on the number of vCPUs configured on your source firewall. After migration, you might have to Set the Number of Licensed vCPUs on the firewall to ensure that the expected number of credits are consumed. Setting the number of licensed vCPUs requires you to reboot your firewall.
    Check and set the number of licensed vCPUs before the migration if you get an error message stating that you don’t have enough credits in the deployment profile to support the request.
    If your VM-Series firewalls are deployed in a production environment, it's recommended that you perform the migration during a maintenance window.
    Complete one of the following procedures to migrate your licenses.

    Standalone Firewall with Access to the CSP

    This process does not disrupt traffic moving through the firewall.
    1. Log in to the VM-Series firewall web interface.
    2. Verify the Palo Alto Networks update server configuration.
      1. Select DeviceSetupServices.
      2. Confirm that Update Server is set to updates.paloaltonetworks.com.
      3. Confirm that Verify Update Server Identity is selected.
    3. Log in to the CSP and Create a Deployment Profile.
      You will use the auth code from this profile. An auth code for a flexible firewall license begins with the letter D, as shown below.
    4. Log in to your VM-Series firewall.
    5. Install a License API Key.
    6. Apply the VM-Series authorization code from the new deployment profile.
      1. Select DeviceLicenses.
        If the current VM-Series model and the VM-Series model you're migrating to are different, select the Upgrade VM Capacity link.
        If the VM-Series model is the same before and after migration, select the Activate feature using authorization code link.
      2. Enter the VM-Series authorization code from the new deployment profile.
      3. Click OK to confirm the license upgrade. The firewall contacts the Palo Alto Networks update server and consumes the tokens required for your firewall based on the VM-Series model.
    7. If you're migrating to a deployment profile with flexible vCPUs, you might have to set the number of vCPUs used by your firewall. Setting the number of licensed vCPUs requires you to reboot your VM-Series firewall for this change to take effect.
      1. Determine if your VM-Series firewall requires fewer vCPUs than the number of available vCPUs on your compute instance.
      2. Set the Number of Licensed vCPUs.
    8. (Optional) Verify the Migration.
    9. Repeat this process for each VM-Series firewall in your deployment.

    Verify the Migration

    Verify that your license migration was successful.
    1. On the device, check the license expiration date to verify the license updated successfully.
    2. Verify that all subscriptions enabled in your deployment profile are applied to your device.
    3. On the CSP, verify that the expected number of credits allocated and credits consumed match your credit pool.
    4. On the CSP, verify that the associated tokens or quantity of licenses have been returned to your previous auth code.

    © 2026 Palo Alto Networks, Inc. All rights reserved.