Focus

VM-Series Deployment Guide

Deactivate License (Software NGFW Credits)

Table of Contents

Deactivate License (Software NGFW Credits)

Deactivate a license before you delete a firewall from the CSP Software NGFW credits deployment profile.

You must deactivate any licenses from the CSP before you delete a firewall (or the VM hosting the firewall) or the license credits cannot return to your credit pool.

When you have internet access to the licensing server, deactivating the firewall on the CSP automatically removes the licenses and the remaining credits are returned to the deployment profile. After you deactivate the license you must delete the firewall or it will continue to consume credits.

If you don’t have internet access, you must export the license token from the firewall. Then, in the CSP, start deactivation and upload the token (or paste in the token text) to complete the deactivation.

Internet access
No internet access
No internet access - Panorama management

Direct internet access.
1. Select ProductsAssetsSoftware NGFW Credits and click the Details button on the credit pool you used to create your deployment profile.
2. Locate your deployment profile, and on the far right, select the vertical ellipsis (More Options) and select Deactivate Firewall.
3. Check the firewall you want to deactivate, and select Deactivate Firewall.
No internet access.
1. Log in to the firewall web interface and select DeviceLicenses.
2. In the License Management section, select Deactivate VM.
  Verify the list of licenses/entitlements to be deactivated on the firewall.
3. Select Complete Manually to start the deactivation.
  Click the Export license token link to save the token file to the client. A token filename looks like this: 20150128_1307_dact_lic.01282015.130737.tok
  At this point the license has been deactivated on the firewall, but the credits have not been returned to the credit pool.
4. Use the token file to register the changes with the Licensing server:
  Log into the Palo Alto Networks Customer Support website.
  Select ProductsVM-Series Auth-CodesDeactivate License(s).
  In the Deactivate Licenses form, paste in the token text, or copy the token to a computer with internet access and upload the token file to the CSP to complete license removal.
5. Delete the VM
No internet access—Panorama management
1. Log in to the Panorama web interface and select PanoramaDevice DeploymentLicenses.
2. Select Deactivate VMs and select the VM-Series firewall that you want to deactivate.
3. Select Complete Manually to export the token file.
4. Click the Export license token link to save the token file. A token filename looks like this: 20150128_1307_dact_lic.01282015.130737.tok
  If the export is successful, a completion message is displayed, and the firewall reboots automatically.
5. Use the token file to register the changes with the licensing server.
  Log into the Palo Alto Networks Customer Support website.
  Select ProductsVM-Series Auth-CodesDeactivate License(s).
  In the Deactivate Licenses form, paste in the token text, or copy the token to a computer with internet access and upload the token file to the CSP to complete license removal.
6. (optional) Remove the deactivated VM-Series firewall as a managed device on Panorama.
  Instead of deleting the deactivated firewalls, you can create a separate device group and assign them to it.
  
  Select PanoramaManaged Devices.
  Select the firewall that you deactivated and click Delete.

Amend and Extend a Credit Pool

Delicense Ungracefully Terminated Firewalls