Update Your GlobalProtect Cloud Service License from Evaluation to Production

Use this workflow to update your GlobalProtect cloud service plugin from an evaluation to a production version.
Before starting this procedure, make sure that your Panorama appliance has active, paid licenses. If your Panorama has an evaluation license, you need to Transfer or Update GlobalProtect Cloud Service Licenses Between Panorama Appliances.
  1. In the Panorama appliance, select PanoramaLicenses.
  2. Make a note or take a screenshot of the licenses you have, the quantity of licenses, and the expiration date of each license.
  3. Remove the evaluation cloud service licenses you have installed.
    1. Open a SSH console session to the Panorama appliance.
    2. Run the delete license key command, then press the Tab key to view all installed license keys.
    3. Delete all GlobalProtect license keys, including the license keys for Cortex Data Lake (formerly Logging Service), GlobalProtect Cloud Service for Mobile Users, and GlobalProtect Cloud Service for Remote Networks.
      The following is an example of the process:
      admin-Panorama> deletelicense key [then click tab]
      GlobalProtect_Cloud_Service_f_2017_11_07.key 2017/11/0712:32:51 0.3K
      GlobalProtect_Cloud_Service_for_Mobile_Users_2017_11_07.key 2018/01/10 13:52:18 0.3K
      GlobalProtect_Cloud_Service_for_Remote_Networks_2017_11_07.key 2018/01/10 13:52:18 0.3K
      Logging_Service_2017_11_07.key 2018/01/10 13:52:18 0.3K
      admin-Panorama> deletelicensekey Logging_Service_2017_11_07.key
      successfully removed Logging_Service_2017_11_07.key
      admin-Panorama> deletelicensekey GlobalProtect_Cloud_Service_f_2017_11_07.key
      successfully removed GlobalProtect_Cloud_Service_f_2017_11_07.key
      admin-Panorama> deletelicensekey GlobalProtect_Cloud_Service_for_Remote_Networks_2017_11_07.key
      successfully removed GlobalProtect_Cloud_Service_for_Remote_Networks_2017_11_07.key
      admin-Panorama> deletelicensekey GlobalProtect_Cloud_Service_for_Mobile_Users_2017_11_07.key
      successfully removed GlobalProtect_Cloud_Service_for_Mobile_Users_2017_11_07.key
  4. From the Panorama administration console, select PanoramaLicenses and click Retrieve license keys from license server.
    This step should refresh the licenses you already have, and the new licenses should reflect the new quantity you purchased and the new expiration date.
  5. Complete the one-time password (OTP) verification procedure and verify the Panorama appliance.
    After you generate the OTP, we recommend deleting any existing certificates using CLI from Panorama, then creating the new certificate with the new OTP by entering the following commands, where value is the new OTP:
    admin-Panorama> request plugins cloud_services panorama-certificate delete
    admin-Panorama> request plugins cloud_services panorama-certificate fetch debug yes otp value
  6. In Panorama, verify that you can make configuration changes and can successfully push the configuration to GlobalProtect cloud service.
    If the licenses do not update correctly, or if you are not able to make configuration changes after the refresh, contact Palo Alto Networks support.

Related Documentation