You are now required to install a license
deactivation API key and enable the firewall to verify the identity
of PAN update servers to deactivate a VM-Series firewall license.
These changes provide additional security to the connection between
your firewall or Panorama and the Palo Alto Networks Update and
License server. You can retrieve your license API key from the Customer
Support Portal and configure it using the CLI on the firewall and
The Verify Update Server Identity option under
enabled by default. Before deactivating an VM-Series firewall, verify
that this option is enabled.