To license the firewall during the bootstrapping
process, you must purchase the auth codes and register the licenses
and subscriptions on the Palo Alto Networks Support portal before
you begin bootstrapping.
For the VM-Series firewalls running
BYOL (not applicable for usage-based licensing—PAYG), you must have
an auth code bundle that includes the capacity auth code, support
subscription, and any other subscriptions you require. The process
of preparing the licenses for bootstrapping depends on whether the
firewall has internet access when bootstrapping:
Internet access—The firewall is connected directly to the Internet.
Indirect Internet access—The firewall is managed by Panorama,
which has direct Internet access and the ability to fetch the license
keys on behalf of the firewall.
No Internet access—The firewall uses an orchestration service
or a custom script to fetch the license keys on behalf of the firewall.
For a custom script or an orchestration service that
can access the Internet on behalf of firewalls.
The script or service must fetch the CPU ID and the UUID
from the hypervisor on which the firewall is deployed and access
the Palo Alto Networks Support portal with CPU ID, UUID, API key
and the auth code to obtain the required keys. See Licensing API.