>
    Strata Copilot
    Deactivate a Feature License or Subscription Using the CLI
    Focus
    Download PDF
    Focus
    1. Home
    2. VM-Series
    3. VM-Series Models
    4. Deactivate License(s)
    5. Deactivate a Feature License or Subscription Using the CLI
    Download PDF
    VM-Series

    Deactivate a Feature License or Subscription Using the CLI

    Table of Contents

    Deactivate a Feature License or Subscription Using the CLI

    Use the CLI to deactivate a fixed model feature license, an ELA license, or a subscription.
    Where Can I Use This?What Do I Need?
    • VM-Series deployment
    • VM-Series 10.x or above
    • Panorama running PAN-OS 10.1.x or above versions
    • Customer Support Portal (CSP) account with one of the following user roles:
      • Superuser, Standard User, Limited User, Threat Researcher, AutoFocus Trial Role, Group superuser, Group Standard User, Group Limited User, Group Threat Researcher, Authorized Support Center (ASC) User, and ASC Full Service User.
      • Superuser access to the VM-Series firewall
    If you installed a license/subscription on a firewall and need to reassign it to another firewall, you can deactivate the individual license and re-use the same authorization code on another firewall without help from Technical Support. This capability is supported in the CLI only and is supported on both physical and virtual devices running PAN-OS. This procedure is typically used with fixed-model perpetual or ELA licenses.

    Internet Access (Auto Mode)

    1. Log into the CLI on the firewall.
    2. View the name of the license key for the feature you want to deactivate.
      request license deactivate key features
    3. Deactivate the license or subscription.
      Use the auto mode to remove the license key.
      request license deactivate key features <name> mode auto
      The name is the full name for the license key file. For example:
      admin@vmPAN2> request license deactivate key features <name>
      WildFire_License_2015_01_28_I5820573.key mode auto007200002599
WildFire License Success
Successfully removed license keys

    No Internet Access (Manual Mode)

    Use manual mode to remove the license key and generate a license token for a model-based license. This procedure assumes you have installed the license API key on your firewall.
    1. Log into the CLI on the firewall.
    2. View the name of the license key for the feature you want to deactivate.
      request license deactivate key features
    3. Deactivate the license manually from the command line.
      request license deactivate key features <name> mode manual
      For example:
      admin@PA-VM> request license deactivate key features
      PAN_DB_URL_Filtering_2015_01_28_I6134084.key mode manual
Successfully removed license keys
dact_lic.01282015.100502.tok
      The token file uses the format dact_lic.timestamp.tok, where the timestamp is in the dmmyyyy.hrminsec format.
    4. Verify that the token file was generated.
      show -token-files
    5. Export the token file.
      Enter this command on a single line:
      scp export license-token-file to <username@serverIP>
      from <token_filename>
      For example:
      scp export license-token-file to admin@10.1.10.55:/tmp/ from dact_lic.01282015.100502.tok
    6. Log into the Palo Alto Networks Customer Support portal.
      1. Click the Deactivate License(s) link on the Assets tab.
      2. Select ProductsVM-Series Auth-Codes and select Deactivate License(s).
      3. Upload the token file to complete the deactivation.

    © 2026 Palo Alto Networks, Inc. All rights reserved.