What Happens When Licenses Expire?

Find out what happens when one of your Palo Alto Networks firewall subscriptions expires.
Palo Alto Networks subscriptions provide the firewall with added functionality and/or access to a Palo Alto Networks cloud-delivered service. Upon license expiration, some subscriptions continue to function in a limited capacity, and others stop operating completely. Here you can find out what happens when each subscription expires.
Subscription
Expiry Behavior
Threat Prevention
Alerts appear in the System Log indicating that the license has expired.
You can still:
  • Use signatures that were installed at the time the license expired.
  • Use and modify Custom App-ID™ and threat signatures.
You can no longer:
  • Install new signatures.
  • Roll signatures back to previous versions.
DNS Security
You can still:
  • Use local DNS signatures if you have an active Threat Prevention license.
You can no longer:
  • Get new DNS signatures.
URL Filtering
You can still:
  • Enforce policy using custom URL categories.
  • Enforce policy using PAN-DB categories that were in your local cache when the license expired.
You can no longer:
  • Get updates to cached PAN-DB categories.
  • Get PAN-DB categories of uncached URLs.
WildFire
You can still:
  • Forward PEs for analysis.
  • Get signature updates every 24-48 hours if you have an active Threat Prevention subscription.
You can no longer:
  • Get five-minute updates through the WildFire public and private clouds.
  • Forward advanced file types such as APKs, Flash files, PDFs, Microsoft Office files, Java Applets, Java files (.jar and .class), and HTTP/HTTPS email links contained in SMTP and POP3 email messages.
  • Use the WildFire API.
  • Use the WildFire appliance to host a WildFire private cloud or a WildFire hybrid cloud.
AutoFocus
You can still:
  • Use an external dynamic list with AutoFocus data for a grace period of three months.
You can no longer:
Cortex Data Lake
You can still:
  • Store log data for a 30-day grace period, after which it is deleted.
  • Forward logs to Cortex Data Lake until the end of the 30-day grace period.
GlobalProtect
You can still:
  • Use the app for endpoints running Windows and macOS.
  • Configure single or multiple internal/external gateways.
You can no longer:
  • Access the Linux OS app and mobile app for iOS, Android, Chrome OS, and Windows 10 UWP.
  • Use IPv6 for external gateways.
  • Run HIP checks.
  • Enable split tunneling.
VM-Series
You can still:
  • Configure and use the firewall(s) you had deployed when the license expired.
Support
You can no longer:
  • Receive software updates.
  • Download VM images.
  • Benefit from technical support.

Recommended For You