Migrate to a Flexible VM-Series License

You can migrate your VM-Series firewall perpetual or ELA license to a flexible VM-Series firewall license (funded using Software NGFW credits) without disrupting traffic moving through the firewall. You can switch the license on an individual firewall or on multiple firewalls simultaneously from Panorama. Complete one of the following procedures to migrate your license.
If you VM-Series firewall is running PAN-OS 10.0.3 and below, you must use the same VM-Series model and number of vCPUs when you Create a Deployment Profile to generate the new authorization code. For example, if you are currently using a VM-100 (using 2 vCPUs), you must select the VM-100 when you create your deployment profile.
  • Switch a license on a standalone firewall.
    1. Log in to the VM-Series firewall web interface.
    2. Verify the Palo Alto Networks update server configuration.
      1. Select
        Device
        Setup
        Services
        .
      2. Confirm that
        Update Server
        is set to updates.paloaltonetworks.com.
      3. Confirm that
        Update Server Identity
        is selected.
    3. Create a Deployment Profile is you have not done so already. This is required to generate your new authorization code.
    4. Apply a VM-Series authorization code. A firewall authorization code for an flexible license begins with the letter D, as shown below.
      1. Select
        Device
        Licenses
        and select the
        Upgrade VM Capacity
        link.
      2. Enter your VM-Series authorization code.
      3. Click
        OK
        to confirm the license upgrade.The firewall contacts the Palo Alto Networks update server and consume the tokens required for your firewall based on the VM-Series model.
    5. Verify the following.
      1. Verify the license updated successfully by checking the license expiration date.
      2. Verify that all subscriptions enabled in your deployment profile are applied to your device.
      3. On the customer support portal, verify that the expected number credits allocated and credits consumed against your credit pool.
      4. On the customer support portal, verify that the associated tokens or quantity of licenses have been returned to your previous authcode.
    6. Repeat this process for each VM-Series firewall in your deployment.
  • Switch licenses on managed firewalls using Panorama.
    1. Log in to the Panorama web interface.
    2. Verify the Palo Alto Networks update server configuration for the firewalls.
      1. Select
        Device
        Setup
        Services
        .
      2. Confirm that
        Update Server
        is set to updates.paloaltonetworks.com.
      3. Confirm that
        Update Server Identity
        is selected.
    3. Create a Deployment Profile is you have not done so already. This is required to generate your new authorization code.
    4. Apply a VM-Series authorization code. A firewall authorization code for an flexible license begins with the letter D, as shown below.
      1. Select
        Device
        Licenses
        and select the
        Upgrade VM Capacity
        link.
      2. Enter your VM-Series authorization code.
      3. Click
        OK
        to confirm the license upgrade.The firewall contacts the Palo Alto Networks update server and consume the tokens required for your firewall based on the VM-Series model.
      4. Verify the license updated successfully by checking the license expiration date.
    5. Apply the new authorization code.
      1. Select
        Panorama
        Device Deployment
        Licenses
        and click
        Activate
        .
      2. Enter your VM-Series authorization code.
      3. Use the filters to select the managed firewalls to be licensed.
      4. Enter your authorization code in the
        Auth Code
        column for each firewall.
      5. Click
        Activate
        to confirm the license upgrade. Panorama contacts the Palo Alto Networks update server and consume the tokens required for your firewalls based on the VM-Series model.
      6. Verify the license updated successfully by checking the license expiration date.
    6. Verify the following.
      1. Verify the license updated successfully by checking the license expiration date.
      2. Verify that all subscriptions enabled in your deployment profile are applied to your device.
      3. On the customer support portal, verify that the expected number credits allocated and credits consumed against your credit pool.
      4. On the customer support portal, verify that the associated tokens or quantity of licenses have been returned to your previous authcode.

Recommended For You