Deactivate License (Software NGFW Credits)

Direct internet access.
Select
Assets
Software NGFW Credits
and click the
Details
button on the credit pool you used to create your deployment profile.
Locate your deployment profile, and on the far right, select the vertical ellipsis (More Options) and select
Deactivate Firewall
.
Check the firewall you want to deactivate, and select
Deactivate Firewall
.
No internet access.
Log in to the firewall web interface and select
Device
Licenses
.
In the License Management section, select
Deactivate VM
.
Verify the list of licenses/entitlements to be deactivated on the firewall.
Select
Complete Manually
to start the deactivation.
Click the
Export license token
link to save the token file to the client. A token filename looks like this:
20150128_1307_dact_lic.01282015.130737.tok
At this point the license has been deactivated on the firewall, but the credits have not been returned to the credit pool.
Use the token file to register the changes with the Licensing server:
Log into the Palo Alto Networks Customer Support website.
Select
Assets
VM-Series Auth-Codes
Deactivate License(s)
.
In the Deactivate Licenses form, paste in the token text, or copy the token to a computer with internet access and upload the token file to the CSP to complete license removal.
Delete the VM
No internet access—Panorama management
Log in to the Panorama web interface and select
Panorama
Device Deployment
Licenses
.
Select Deactivate VMs
and select the VM-Series firewall that you want to deactivate.
Select
Complete Manually
to export the token file.
Click the
Export license token
link to save the token file. A token filename looks like this: 20150128_1307_dact_lic.01282015.130737.tok
If the export is successful, a completion message is displayed, and the firewall reboots automatically.
Use the token file to register the changes with the licensing server.
Log into the Palo Alto Networks Customer Support website.
Select
Assets
VM-Series Auth-Codes
Deactivate License(s)
.
In the Deactivate Licenses form, paste in the token text, or copy the token to a computer with internet access and upload the token file to the CSP to complete license removal.
(
optional
) Remove the deactivated VM-Series firewall as a managed device on Panorama.
Instead of deleting the deactivated firewalls, you can create a separate device group and assign them to it.
Select
Panorama
Managed Devices
.
Select the firewall that you deactivated and click
Delete
.