Switch Between VM-Series Model Licenses

Table of Contents

Switch Between the BYOL and the PAYG Licenses

Switch Between VM-Series Model Licenses

Use this procedure to switch the license of your VM-Series firewall from one type to another, such as a subscription bundle to an ELA.

Where Can I Use This?	What Do I Need?
VM-Series deployment	VM-Series 10.x or above Panorama running PAN-OS 10.1.x or above versions Customer Support Portal (CSP) account with one of the following user roles: Superuser, Standard User, Limited User, Threat Researcher, AutoFocus Trial Role, Group superuser, Group Standard User, Group Limited User, Group Threat Researcher, Authorized Support Center (ASC) User, and ASC Full Service User. Superuser access to the VM-Series firewall

Where Can I Use This?

What Do I Need?

VM-Series deployment

VM-Series 10.x or above
Panorama running PAN-OS 10.1.x or above versions
Customer Support Portal (CSP) account with one of the following user roles:
- Superuser, Standard User, Limited User, Threat Researcher, AutoFocus Trial Role, Group superuser, Group Standard User, Group Limited User, Group Threat Researcher, Authorized Support Center (ASC) User, and ASC Full Service User.
- Superuser access to the VM-Series firewall

You can switch the license of your currently-deployed VM-Series firewall with the BYOL option. For example, you can move from a subscription bundle to an enterprise license agreement (ELA) and vice versa, without disrupting traffic moving through the firewall. You can also switch the license on an individual firewall or on multiple firewalls simultaneously from Panorama.

Do not use this procedure for switching ELA or perpetual licenses between PAYG and BYOL. See Switch Between the BYOL and the PAYG Licenses for more information.

Complete one of the following procedures to perform one of the following license changes:

Subscription bundle 1 to subscription bundle 2
Subscription bundle 1 or 2 to an ELA
Capacity license to subscription bundle or ELA

Before switching to an ELA license, you must allocate enough tokens to support the number of currently-deployed VM-Series firewalls. See VM-Series Enterprise License Agreement (Multi-Model ELA) for more information about the tokens required for each VM-Series model.

Switch a license on a standalone firewall.
1. Register your authorization code.
  For a subscription bundle, register your new authorization code.
  For an ELA, activate the ELA authorization code.
  
  Do not use the ELA authorization code to activate individual VM-Series firewalls. After registering your ELA, use the VM-Series model authorization codes to activate individual firewalls. You can find these authorization codes on the Customer Support Portal under ProductsVM-Series Auth-Codes.
2. Log in to the VM-Series firewall web interface.
3. Verify the Palo Alto Networks update server configuration.
  Select DeviceSetupServices.
  Confirm that Update Server is set to updates.paloaltonetworks.com.
  Confirm that Update Server Identity is selected.
4. Apply a VM-Series authorization code. A firewall authorization code for an ELA begins with the letter A, as shown below.
  Select DeviceLicenses and select the Activate feature using authorization code link.
  Enter your VM-Series authorization code.
  Click OK to confirm the license upgrade.The firewall contacts the Palo Alto Networks update server and consume the tokens required for your firewall based on the VM-Series model.
  Verify the license updated successfully by checking the license expiration date.
5. Repeat this process for each VM-Series firewall in your deployment.
Switch licenses on managed firewalls using Panorama.
1. Register your authorization code.
  For a subscription bundle, register your new authorization code.
  For an ELA, activate the ELA authorization code.
  
  Do not use the ELA authorization code to activate individual VM-Series firewalls. After registering your ELA, use the VM-Series model authorization codes to activate individual firewalls. You can find these authorization codes on the Customer Support Portal under ProductsVM-Series Auth-Codes.
2. Log in to the Panorama web interface.
3. Verify the Palo Alto Networks update server configuration for the firewalls.
  Select DeviceSetupServices.
  Confirm that Update Server is set to updates.paloaltonetworks.com.
  Confirm that Update Server Identity is selected.
4. Apply a VM-Series authorization code. A firewall authorization code for an ELA begins with the letter A, as shown below.
  Select PanoramaDevice DeploymentLicenses and click Activate.
  Enter your VM-Series authorization code.
  Use the filters to select the managed firewalls to be licensed.
  Enter your authorization code in the Auth Code column for each firewall.
  Click Activate to confirm the license upgrade.Panorama contacts the Palo Alto Networks update server and consume the tokens required for your firewalls based on the VM-Series model.
  
  Verify the license updated successfully by checking the license expiration date.