To license the firewall during the bootstrapping process, you must purchase the auth codes and register the licenses and subscriptions on the Palo Alto Networks Support portal before you begin bootstrapping.
For the VM-Series firewalls running BYOL (not applicable for usage-based licensing—PAYG), you must have an auth code bundle that includes the capacity auth code, support subscription, and any other subscriptions you require. The process of preparing the licenses for bootstrapping depends on whether the firewall has internet access when bootstrapping:
Direct Internet access—The firewall is connected directly to the Internet. Indirect Internet access—The firewall is managed by Panorama, which has direct Internet access and the ability to fetch the license keys on behalf of the firewall. No Internet access—The firewall uses an orchestration service or a custom script to fetch the license keys on behalf of the firewall.
Prepare the Licenses for Bootstrapping
For VM-Series firewalls with Internet access. Enter the auth code in the /license folder when you Prepare the Bootstrap Package.
For VM-Series firewalls with indirect Internet access. Register the auth code on the Palo Alto Networks Support portal. Go to support.paloaltonetworks.com, log in, and select Assets > Register New Device > Register device using Serial Number or Authorization Code. Follow the steps to Register the VM-Series Firewall Click Submit. Activate the auth codes on the Palo Alto Networks Support portal to generate license keys. Go to support.paloaltonetworks.com, log in, and select the Assets tab. For each S/N, click the Action link. Select the Activate Auth-Code button. Enter the Authorization code, click Agree, and Submit. Download the license keys and save it to a local folder. Continue to Prepare the Bootstrap Package ; you must add the license keys that you downloaded to the \license folder in the bootstrap package.
For a custom script or an orchestration service that can access the Internet on behalf of firewalls. The script or service must fetch the CPU ID and the UUID from the hypervisor on which the firewall is deployed and access the Palo Alto Networks Support portal with CPU ID, UUID, API key and the auth code to obtain the required keys. See Licensing API.

Related Documentation