Upgrade the VM-Series Model

The licensing process for the VM-Series firewall uses the UUID and the CPU ID to generate a unique serial number for each VM-Series firewall. Hence, when you generate a license, the license is mapped to a specific instance of the VM-Series firewall and cannot be modified.
Use the instructions in this section, if you are:
  • Migrating from an evaluation license to a production license.
  • Upgrading the model to allow for increased capacity. For example you want to upgrade from the VM-100 to the VM-300 model.
A capacity upgrade restarts some critical processes on the firewall. An HA configuration is recommended to minimize service disruption; to upgrade the capacity on a HA pair, see Upgrade the VM-Series Model in an HA Pair.
  1. Retrieve the license deactivation API key from the Customer Support Portal.
    1. Log in to the Customer Support Portal.
    2. From the Go To drop-down, select License API.
    3. Copy the API key.
    license-api-key-csp.png
    Make sure that you are using the same account that you used to register the initial license.
  2. On the firewall, use the CLI to install the API key copied in the previous step.
    request license api-key set key <key>
  3. Enable the firewall to Verify Update Server identity on DeviceSetupService.
  4. Commit your changes.
  5. Continue to the next step if you are upgrading capacity. If you are migrating your license, do the following
    1. Register the VM-Series Firewall.
    2. Retrieve the license keys on the firewall. See Activate the License.
    3. Go to the last step to verify that your firewall is licensed successfully.
  6. Upgrade the license on the Customer Support portal.
    Skip this step if you are upgrading the capacity with an authorization code.
    1. Log in to the Palo Alto Networks Customer Support portal.
    2. Select AssetsDevices and search for your firewall by the serial number.
    3. Select the Action icon to open the Device Licenses window.
    4. Select Activate Upgrade License and enter the authorization code for the higher capacity VM.
      capacity_upgrade_authcode.png
    5. Select Agree and Submit.
    6. (Optional) If your VM-Series firewall does not have direct internet access, download the capacity upgrade license key.
      1. Select AssetsDevices and search for your firewall by the serial number.
      2. Under the License column, select the download icon next to PA-VM to download the license key.
      3. Save the license key to a location the VM-Series firewall can access.
        capacity_upgrade_license_list.png
  7. Allocate additional hardware resources to your VM-Series firewall.
    Before initiating the capacity upgrade, you must verify that enough hardware resources are available to the VM-Series firewall to support the new capacity. The process for assigning additional hardware resources differs on each hypervisor.
    To check the hardware requirements for your new VM-Series model, see VM-Series Models.
    Although the capacity upgrade does not require a reboot of the VM-Series firewall, you need to power down the virtual machine to change the hardware allocation.
  8. Upgrade the capacity.
    Select DeviceLicensesUpgrade Capacity and then activate your licenses and subscriptions in one of the following ways:
    • Retrieve license keys from license server—Use this option if you activated your license on the Customer Support portal.
    • Manually upload license key—Use this option if your firewall does not have connectivity to the Palo Alto Networks Customer Support web site. In this case, you must download a license key file from the support site on an Internet connected computer and then upload to the firewall.
    • Use an authorization code—Use this option to upgrade the VM-Series capacity using an authorization code for licenses that have not been previously activated on the support portal. When prompted, enter the Authorization Code and then click OK.
  9. Verify that your firewall is licensed successfully.
    On the DeviceLicenses page, verify that the license was successfully activated.

Related Documentation