The license deactivation process enables you to self-manage licenses. Whether you want to remove one or more active licenses or subscriptions attributed to a firewall (hardware-based or VM-Series firewall) or you want to deactivate the VM-Series firewall and unassign all active licenses and subscriptions, begin the deactivation process on the firewall or Panorama (not on the Palo Alto Networks Customer Support web site).
The VM-Series firewall requires a license deactivation API key and it must be able to verify the identify of the license server, to automatically deactivate a license. The firewall uses this deactivation API key to authenticate with all update and license services. The deactivation API is key is not required for manual license deactivation, where there is not connectivity between the firewall and license server.
If the firewall/Panorama has internet access and can communicate with the Palo Alto Networks Licensing servers, the license removal process completes automatically with a click of a button. If the firewall/Panorama does not have internet access, you must complete the process manually in a two-step process. In the first step, from the firewall or Panorama, you generate and export a license token file that includes information on the deactivated keys. In the second step, while logged in to the
Palo Alto Networks Customer Support web site, upload the token file to dissociate the license keys from the firewall.