VM-Series Firewall in Amazon Web Services (AWS) and Azure Licenses

You can license the VM-Series firewall in AWS and Azure in two ways:
  • Bring Your Own License (BYOL)—A license that is purchased from a partner, reseller, or directly from Palo Alto Networks. Both Individual capacity and support licenses and subscription bundles are supported for BYOL. With individual licenses, you must apply the auth code after you deploy the VM-Series firewall; with a bundle, you can include a single auth code in the bootstrap package for all the subscriptions included in the bundle in order to license the firewall at launch.
  • Usage-Based License—Also called a pay-per-use or pay-as-you-go (PAYG) license. This type of license can be purchased from the AWS Marketplace and the Azure public Marketplace. Usage-based licenses are not available on the Azure Government Cloud Marketplace.
    AWS supports hourly and annual PAYG options; Azure supports the hourly PAYG option only.
    With the usage-based licenses, the firewall is prelicensed and ready for use as soon as you deploy it; you do not receive an auth code. When the firewall is stopped or terminated on the AWS or Azure console, the usage-based licenses are suspended or terminated.
    Usage-based licenses are available in the following pricing bundles:
    • Bundle 1: Includes the VM-Series capacity license (VM-300 only), Threat Prevention license that includes IPS, AV, malware prevention, and a premium support entitlement.
    • Bundle 2: Includes the VM-Series capacity license (VM-300 only), Threat Prevention (includes IPS, AV, malware prevention), GlobalProtect, WildFire, PAN-DB URL Filtering licenses, and a premium support entitlement.
      If you have an evaluation copy of the VM-Series firewall and would like to convert it to a fully licensed (purchased) copy for the same license type (BYOL to BYOL), you can deactivate the evaluation license and activate the purchased license in place. See Upgrade the VM-Series Firewall for instructions.
You cannot switch between the PAYG and the BYOL licenses. To move from PAYG to BYOL, contact your Palo Alto Networks channel partner or sales representative to purchase a BYOL license and get an BYOL auth code that you can use to license your firewall. If you have deployed your firewall and want to switch the license, see Switch Between the BYOL and the PAYG Licenses.

Related Documentation