Migrate a Firewall to a Flexible VM-Series License
Table of Contents
Migrate a Firewall to a Flexible VM-Series License
Migrate from a model-based license to flexible Software
Next Generation firewall credits.
You can migrate your VM-Series firewall perpetual or ELA license to a flexible
VM-Series firewall license (funded using Software NGFW credits).
When you
migrate from a perpetual or ELA license, you might need to reboot your firewall to
complete the migration. In a fixed vCPU deployment profile, the firewall consumes
credits based upon the VM-Series model. After migrating to a deployment profile with
fixed vCPUs, each firewall keeps its serial number and does not require a reboot. In a
deployment profile with flexible vCPUs, the firewall consumes credits based on the
number of vCPUs configured on your source firewall. After migration, you might have to
Set the Number of Licensed vCPUs on the firewall to ensure that the expected number of credits are
consumed. Setting the number of licensed vCPUs requires you to reboot your
firewall.Check and set the number of licensed vCPUs before the migration if you
get an error message stating that you do not have enough credits in the deployment
profile to support the request.
If your VM-Series firewalls are deployed in
a production environment, it is recommended that you perform the migration during a
maintenance window.
Complete one of the following procedures to migrate
your licenses.
Standalone Firewall with Access to the CSP
This process does not disrupt traffic moving through the firewall.
- Log in to the VM-Series firewall web interface.Verify the Palo Alto Networks update server configuration.
- Select .Confirm that Update Server is set to updates.paloaltonetworks.com.Confirm that Verify Update Server Identity is selected.Log in to the CSP and Create a Deployment Profile.You will use the auth code from this profile. An auth code for a flexible firewall license begins with the letter D, as shown below.
![]()
Log into your VM-Series firewall.Install a License API Key.Apply the VM-Series authorization code from the new deployment profile.- Select .If the current VM-Series model and the VM-Series model you are migrating to are different, select the Upgrade VM Capacity link.If the VM-Series model is the same before and after migration, select the Activate feature using authorization code link.Enter the VM-Series authorization code from the new deployment profile.Click OK to confirm the license upgrade. The firewall contacts the Palo Alto Networks update server and consumes the tokens required for your firewall based on the VM-Series model.If you are migrating to a deployment profile with flexible vCPUs, you might have to set the number vCPUs used by your firewall. Setting the number of licensed vCPUs requires you to reboot your VM-Series firewall for this change to take effect.
- Determine if your VM-Series firewall requires fewer vCPUs than the number of available vCPUs on your compute instance.Set the Number of Licensed vCPUs.(Optional) Verify the Migration.Repeat this process for each VM-Series firewall in your deployment.
Verify the Migration
Verify that your license migration was successful.- On the device, check the license expiration date to verify the license updated successfully.Verify that all subscriptions enabled in your deployment profile are applied to your device.On the CSP, verify that the expected number of credits allocated and credits consumed match your credit pool.On the CSP, verify that the associated tokens or quantity of licenses have been returned to your previous auth code.
