Transfer or Update GlobalProtect Cloud Service Licenses Between Panorama Appliances

Use the following workflow if you need to transfer GlobalProtect cloud service licenses from one Panorama appliance to another, for example:
  • If you need to transfer production (paid) licenses from one Panorama appliance to another.
  • If you are running an evaluation license on a Panorama appliance that also has an evaluation license. In this case, you must transfer the production GlobalProtect cloud service license from an evaluation to a production Panorama appliance.
GlobalProtect cloud service automatically preserves all instances and public and loopback IP addresses during the license transfer.
  1. (Optional) Export a snapshot of your Panorama configuration to a host external to Panorama or to a firewall.
    While GlobalProtect cloud service saves all its infrastructure settings, including public and loopback IP addresses, you need to transfer any Panorama-specific configuration to the new Panorama appliance. You can export your configuration after the license transfer process is complete, but we recommend exporting it before you transfer the licenses as a best practice.
  2. Log in to the Palo Alto Networks Customer Support Portal.
  3. Select AssetsDevices.
  4. Find the production Panorama appliance to which you will be transferring the production GlobalProtect cloud service plugin and complete these steps:
    1. Verify that it has an active support license.
    2. Make a note of this serial number; you use it in a later step.
  5. Search for the current Panorama appliance you are using to run the GlobalProtect cloud service by using the serial number.
    The model name should be in the format PAN-PRA-25-Exx.
  6. Click the Actions icon for the current Panorama appliance.
  7. Select Transfer Licenses and choose the Panorama appliance to which you will be migrating.
  8. Review the EULA and click Agree, then click Submit.
  9. Wait for a confirmation message in the Support Portal for a successful transfer.
  10. After the successful transfer of licenses, login to the administration console of your production Panorama appliance.
  11. Select PanoramaSupport and verify that the Panorama appliance has a valid support license.
  12. Click Dashboard and verify that the running software version is 8.0.5 or later, 8.1.0 or later (except 8.1.2), or 9.0.0 or later.
    You must update your software to these minimum versions for Cortex Data Lake and GlobalProtect cloud service to work.
    While using Panorama 9.0 is supported with GlobalProtect cloud service, upgrading to Panorama 9.0 does not give you access to 9.0 features in GlobalProtect cloud service. The GlobalProtect cloud service infrastructure supports PAN-OS features up to release 8.1.
  13. Verify that the Panorama appliance is configured to use NTP by selecting PanoramaSetupServicesNTP and setting a value, such as, for the NTP Server.
  14. Install the Cloud Services Plugin.
  15. Select PanoramaLicenses and click Retrieve license keys from license server.
    This should refresh the screen with recently transferred GlobalProtect Cloud Service and Cortex Data Lake licenses you purchased. If the cloud service licenses do not appear, contact Palo Alto Networks Support for assistance.
  16. Complete the one-time password (OTP) verification procedure and verify the Panorama appliance.
  17. Migrate the configuration from the previous Panorama appliance to the current Panorama appliance.
    • If the production Panorama appliance is completely new, export the configuration from the Panorama appliance you used during the evaluation (if you have not done so already) and import it to this Panorama appliance.
    • If this is the Panorama appliance that you have been using to manage your existing VMs and devices, load a partial configuration to this Panorama appliance.
    You can now use this Panorama appliance to configure and manage the GlobalProtect cloud service.

Related Documentation