Focus

Panorama Administrator's Guide

Manage Licenses on Firewalls Using Panorama

Table of Contents

Manage Licenses on Firewalls Using Panorama

The following steps describe how to retrieve new licenses using an authentication (auth) code and push the license keys to managed firewalls. It also describes how to manually update (refresh) the license status of firewalls that both have direct internet access and those that do not have direct internet access. Panorama™ automatically performs a daily check-in with the licensing server, retrieves license updates and renewals, and pushes them to the firewalls. The check-in is hard-coded to occur between 1 a.m. and 2 a.m.; you cannot change this schedule.

You cannot use Panorama to activate the support license for firewalls. You must access the firewalls individually to activate their support licenses.

To activate licenses for Panorama, see Register Panorama and Install Licenses.

You can use Panorama® to centrally deploy and manage licenses on your managed firewalls. Panorama supports two licensing methods depending on whether your firewalls have internet connectivity:

Managing licenses using Auth Code —Activate licenses using an authentication (auth) code provided by Palo Alto Networks®. This method requires Panorama and the managed firewalls to have a direct internet connection to reach the Palo Alto Networks licensing server. Panorama automatically performs a daily check-in with the licensing server, retrieves license updates and renewals, and pushes them to the firewalls. The check-in is hard-coded to occur between 1 a.m. and 2 a.m.; you cannot change this schedule.

You cannot use Panorama to activate the support license for firewalls. You must access the firewalls individually to activate their support licenses.
To activate licenses for Panorama, see Register Panorama and Install Licenses.
(PAN-OS 12.1.8 and later releases) Managing licenses using license keys—Deploy licenses to air-gapped hardware firewalls without requiring an internet connection on Panorama or the managed firewalls during activation. You obtain .key license key files from the Palo Alto Networks Customer Support Portal using an internet-connected device, upload them to Panorama, and Panorama distributes and activates them on the managed firewalls over the management channel.

Managing licenses using Auth Code

The following steps describe how to retrieve new licenses using an authentication (auth) code and push the license keys to managed firewalls. It also describes how to manually update (refresh) the license status of firewalls that both have direct internet access and those that do not have direct internet access.
1. Activate newly purchased licenses.
  Select PanoramaDevice DeploymentLicenses and Activate.
  Enter the Auth Code that Palo Alto Networks provided for each firewall that has a new license.
  Activate the license.
  (WildFire® subscriptions only) Perform a commit on each firewall that has a new WildFire subscription to complete the activation:
  Commit any pending changes. You must access each firewall web interface to do this.
  If no configuration changes are pending, make a minor change and Commit. For example, update a rule description and commit the change. If the firewalls belong to the same device group, you can push the rule change from Panorama to initiate a commit on all those firewalls instead of accessing each firewall separately.
  
  Check that the WildFire Analysis profile rules include the advanced file types that the WildFire subscription supports.
2. Update the license status of firewalls.
  Select PanoramaDevice DeploymentLicenses.
  Each entry on the page indicates whether the license is active or inactive and displays the expiration date for active licenses.
  If you previously activated auth codes for the support subscription directly on the firewalls, click Refresh and select the firewalls from the list. Panorama retrieves the license, deploys it to the firewalls, and updates the licensing status on the Panorama web interface.
  (Enterprise Data Loss Prevention (DLP) license only) Push the updated license to the managed firewalls leveraging Enterprise DLP:
  Select Commit and Commit to Panorama.
  Select CommitPush to Devices and Edit Selections.
  Select Templates and select the template stack associated with the managed firewalls leveraging Enterprise DLP.
  Click OK to continue.
  Push the template configuration to successfully update the Enterprise DLP license.
  
  When you perform a license activation or refresh operation, the Pending Changes status is set to Yes by default. You must perform a Commit to finalize the license update and save the configuration.
(PAN-OS 12.1.8 and later releases) Managing licenses using license keys

The following steps explain how to upload license key files to Panorama and activate without requiring an internet connection on Panorama or the managed firewalls.

Managing licenses using license keys is applicable to hardware NGFWs managed by Panorama only.
1. Upload license key files to Panorama.
  Select PanoramaDevice DeploymentLicenses.
  Select Upload License.
  The Upload License dialog box opens.
  Select Add File and browse to select one or more .key license files from your local system.
  You can upload multiple license key files at the same time.
  Click Add.
  The Upload License dialog box displays the following details: Firewall Name, Serial Number, License Type (for example, GlobalProtect®, WildFire®, URL, SD-WAN), Expiry, and File Name.
  
  License key files must have a .key extension. If the file extension is missing, the file is corrupted, or the file format is invalid, Panorama displays an invalid file error. Obtain a valid .key file from the Customer Support Portal and retry.
  
  Click OK.
2. Activate the uploaded licenses on managed firewalls.
  Select PanoramaDevice DeploymentLicenses and select Activate.
  The Activate License Deployment dialog box appears.
  Select the License Key tab.
  The tab lists all license key files that have been uploaded to Panorama and are available for activation.
  Select the checkbox next to each license you want to activate.
  Select Activate.
  Panorama transfers the selected license key files to the respective air-gapped firewalls over the management channel. Each firewall installs the license locally from the transferred file.
3. Updated license status of the managed firewalls.
  Manually refresh the license status for air-gapped firewalls that were already managed by Panorama before you began using license key deployment. Air-gapped firewalls that were already managed by Panorama before you adopted license key deployment do not automatically update their license status on Panorama. You must manually trigger a refresh from the Panorama CLI so that Panorama retrieves the current license state from those firewalls and reflects it accurately in Licenses page.
  On the Panorama CLI, run the following command, replacing <device-list> with the serial numbers or device group of the target firewalls:
  request batch license offline refresh devices <device-list>
  
  Panorama contacts each specified firewall over the management channel, retrieves its installed license information, and updates the displayed license status without requiring an internet connection on either Panorama or the firewalls.

Manage Licenses and Updates

Monitor Network Activity