Behavior on License Expiry

If the Threat Prevention subscription on the firewall expires, the following will occur:
A system log entry is generated; the entry states that the subscription has expired.
The firewall will continue blocking threats based on the signatures installed at the time that the license expired, unless you install a new Applications-only content update either manually or as part of an automatic schedule. If you do, the update will delete your existing threat signatures and you will no longer receive protection against them.
New signatures cannot be installed until a valid license is installed. Also, the ability to roll back to a previous version of the signatures is not supported if the license is expired.
Custom App-ID™ signatures will continue to function and can be modified.
If the support license expires, Threat Prevention and Threat Prevention updates will continue to function normally.
If your support entitlement expires, software updates will no longer be available. You will need to renew your license to continue to access software updates and to interact with the technical support group.
If a VM capacity license expires or your VM-ELA expires, the firewall will continue operating without any changes to session capacity per the model specifications. However, you will not receive software or content updates on the firewall until you renew the license.  
Although you might have a valid subscription (Threat Prevention or WildFire, for example) and support license, you must have a valid capacity license to obtain the latest software or content updates.