Migrate to a Flexible VM-Series License

Firewall can access the CSP
—Migrate a license on a standalone firewall
This process does not disrupt traffic moving through the firewall.
Log in to the VM-Series firewall web interface.
Verify the Palo Alto Networks update server configuration.
Select
Device
Setup
Services
.
Confirm that
Update Server
is set to
updates.paloaltonetworks.com
.
Confirm that
Verify Update Server Identity
is selected.
Log in to the CSP and Create a Deployment Profile. If the license you want to migrate is for a VM-Series firewall with an ELA or perpetual license, you must choose
Fixed Models
and use the same VM-Series model and number of vCPUs when you create the SW NGFW deployment profile for the flexible license.
You will use the auth code from this profile. An auth code for a flexible firewall license begins with the letter D, as shown below.

Select
Device
Licenses
.
If the current VM-Series model and the VM-Series model you are migrating to are different, select the
Upgrade VM Capacity
link.
If the VM-Series model is the same before and after migration, select the
Activate feature using authorization code
link.
Enter the VM-Series authorization code from the new deployment profile.
Click
OK
to confirm the license upgrade.The firewall contacts the Palo Alto Networks update server and consumes the tokens required for your firewall based on the VM-Series model.
(
Optional
) Verify the migration.
Repeat this process for each VM-Series firewall in your deployment.
Firewall cannot access the CSP
—Migrate a license on an offline firewall
If necessary, install the license API key on your VM-Series firewall.
Use the CLI to use manual mode to deactivate the fixed-model license.
Deactivate the VM from the Firewall using the manual procedure, and log in to the CSP and use the token file to deactivate the VM.
In the CSP, Create a Deployment Profile with the same VM-Series model, number of vCPUs, and security subscriptions as the old fixed model license. You will use the auth code from this profile.
Select the new profile and click the vertical ellipsis and select
Register Firewall
.
Enter the VM and firewall information and select
Submit
. This associates the firewall with the profile and its authcode and assigns a serial number.
Click
View Devices
to see associated devices in
Software NGFW Devices
.
In the
License
column, download the license keys to a location from which you can safely transfer the files to the host machine.
On the firewall select
Device
Licenses
.
License keys must be installed through the web interface. The firewall does not support license key installation through SCP or FTP.
Click
Manually Upload License
and enter the license keys.
Confirm that the
Dashboard
displays a valid serial number and that the
PA-VM
license displays in the
Device
Licenses
tab.
(
optional
) Verify the migration.
Panorama can access the CSP
—Migrate licenses on Panorama managed firewalls.
Before you begin, ensure that you install a License API key on the firewall.
Log in to the Panorama web interface.
Verify the Palo Alto Networks update server configuration for the firewalls.
Select
Device
Setup
Services
.
Confirm that
Update Server
is set to
updates.paloaltonetworks.com
.
Confirm that
Verify Update Server Identity
is selected.
Create a Deployment Profile for the new license if you have not done so already. This profile is required to generate the new authorization code for the migrated Panorama.
Retrieve the VM-Series authorization code. A firewall authorization code for a flexible license begins with the letter D, as shown below.

Apply the new authorization code.
Select
Panorama
Device Deployment
Licenses
and
Activate
.
Enter your VM-Series authorization code.
Use the filters to select the managed firewalls to be licensed.
Enter your authorization code in the
Auth Code
column for each firewall.

Activate
to confirm the license upgrade. Panorama contacts the Palo Alto Networks update server and consumes the tokens required for your firewalls based on the VM-Series model, vCPUs, and services you have chosen.
(
optional
) Verify the migration.
Panorama cannot access the CSP
—Migrate licenses on offline Panorama managed firewalls
Before you begin, ensure that you install a License API key on the firewall.
Deactivate the VM from Panorama using the manual procedure, and log in to the CSP and use the token file to deactivate the VM.
In the CSP, Create a Deployment Profile with the same VM-Series model, number of vCPUs, security subscriptions, and Panorama as the fixed model license. You will use the auth code from this profile.
Select the new profile and click the vertical ellipsis and select
Register Firewall
.
Enter the VM and firewall information and select
Submit
. This associates the firewall with the profile and its authcode and assigns a serial number.
Click
View Devices
to see associated devices in
Software NGFW Devices
.
In the
License
column, download the license keys to a location from which you can safely transfer the files to the host machine.
Apply the new authorization code.
Select
Panorama
Device Deployment
Licenses
and click
Activate
.
Use the filters to select the managed firewalls to be licensed.
Enter your authorization code from your deployment profile in the
Auth Code
column for each firewall.

Click
Activate
to confirm the license upgrade. Panorama contacts the Palo Alto Networks update server and consumes the tokens required for your firewalls based on the VM-Series model, vCPUs, and services you have chosen.
(
optional
) Verify the migration.
Verify the migration
Check the license expiration date to verify the license updated successfully.
Verify that all subscriptions enabled in your deployment profile are applied to your device.
On the CSP, verify the expected number of credits allocated and credits consumed against your credit pool match.
On the CSP, verify that the associated tokens or quantity of licenses have been returned to your previous auth code.