When you no longer need a BYOL instance of the VM-Series firewall, you can free up all active licenses—subscription licenses, VM-Capacity licenses, and support entitlements— using the web interface, CLI, or the XML API on the firewall or Panorama. The licenses are credited back to your account and you can use the same authorization codes on a different instance of the VM-Series firewall.
Deactivating a VM removes all the licenses/entitlements and places the VM-Series firewall in an unlicensed state; the firewall will not have a serial number and can support only a minimal number of sessions. Because the configuration on the firewall is left intact, you can re-apply a set of licenses and restore complete functionality on the firewall, if needed.
Make sure to deactivate licenses before you delete the VM-Series firewall. If you delete the firewall before deactivating the licenses you have two options:
- If the device was managed by Panorama, you can deactivate the license from Panorama.
- If the device was not managed by Panorama, you must contact Palo Alto Networks Customer Support.
- From the firewall
- Log into the web interface and select DeviceLicenses.
- Select Deactivate VM in the License Management section.
- Verify the list of licenses/entitlements that will be deactivated on the firewall.
- Pick one of the following options to start deactivating
- Click Continue, if the firewall can communicate directly with the Palo Alto Networks Licensing server. You will be prompted to reboot the firewall; on reboot the licenses are deactivated.
- Click Complete Manually, if the firewall does not have internet access. Click the Export license token link to save the token file to your local computer. For example, the token filename is 20150128_1307_dact_lic.01282015.130737.tok. You will be prompted to reboot the firewall; on reboot the licenses are deactivated.
- (Manual process only) Complete the following tasks to register the changes with the Licensing server:
- From Panorama
- Log in to the Panorama web interface and select PanoramaDevice DeploymentLicenses.
- Deactivate VMs and select the VM-Series firewall that you want to deactivate.
- Pick one of the following options to deactivate the
- Continue—If Panorama can communicate directly with the Palo Alto Networks Licensing servers and can register the changes. To verify that the licenses have been deactivated on the firewall, click Refresh on PanoramaDevice DeploymentLicenses. The firewall is automatically rebooted.
- Complete Manually—If Panorama does not have internet access. Panorama generates a token file. Click the Export license token link to save the token file to your local computer. The successful completion message is displayed on-screen, and the firewall will be automatically rebooted.
- (Manual process only) To use the token file register the changes with the licensing server, see step e above.
- Remove the deactivated VM-Series firewall as a managed
device on Panorama.
- Select PanoramaManaged Devices.
- Select the firewall that you deactivated from the list of managed devices, and click Delete.Instead of deleting the firewalls, if you prefer, you can create a separate device group and assign the deactivated VM-Series firewalls to this device group.
Deactivate the License(s)
Deactivate the License(s) The license deactivation process enables you to self-manage licenses. Whether you want to remove one or more active licenses or subscriptions attributed ...
Manage Firewall Licenses
Manage Firewall Licenses Panorama > Device Deployment > Licenses Select Panorama Device Deployment Licenses to perform the following tasks: Update licenses of firewalls that don’t ...
Device > Licenses
Device > Licenses Select Device Licenses to activate licenses on all firewall models. When you purchase a subscription from Palo Alto Networks, you receive an ...
Deactivate a Feature License or Subscription Using the CLI
Deactivate a Feature License or Subscription Using the CLI If you accidentally installed a license/subscription on a firewall and need to reassign the license to ...
Install a License Deactivation API Key
Install a License Deactivation API Key Retrieve your license API key from the Customer Support Portal and install it using the CLI on the firewall ...
VM-Series License Deactivation API Key
VM-Series License Deactivation API Key You are now required to install a license deactivation API key and enable the firewall to verify the identity of ...
Managed Firewall Information
Managed Firewall Information Select Panorama Managed Devices to display the following information for each managed firewall. Managed Firewall Information Description Device Group Displays the name ...
Enable Communication Between the NSX Manager and Panorama
Enable Communication Between the NSX Manager and Panorama To automate the provisioning of the VM-Series firewall for NSX, enable communication between the NSX Manager and ...
Activate the License for the VM-Series Firewall (Standalone...
Activate the License for the VM-Series Firewall (Standalone Version) If you have not elected to use the bootstrapping workflow using a subscription bundle, you must ...