VM-Series Firewall in Amazon Web Services (AWS) and Azure
You can license the VM-Series firewall in AWS and Azure
in two ways:
Bring Your Own License (BYOL)
—A license that is
purchased from a partner, reseller, or directly from Palo Alto Networks.
Both Individual capacity and support licenses and subscription bundles
are supported for BYOL. With individual licenses, you must apply
the auth code after you deploy the VM-Series firewall; with a bundle,
you can include a single auth code in the bootstrap package for
all the subscriptions included in the bundle in order to license
the firewall at launch.
—Also called a
license. This type of license can be purchased from the AWS Marketplace
and the Azure public Marketplace. Usage-based licenses are not available
on the Azure Government Cloud Marketplace.
AWS supports hourly
and annual PAYG options; Azure supports the hourly PAYG option only.
the usage-based licenses, the firewall is prelicensed and ready
for use as soon as you deploy it; you do not receive an auth code.
When the firewall is stopped or terminated on the AWS or Azure console, the
usage-based licenses are suspended or terminated.
licenses are available in the following pricing bundles:
1: Includes the VM-Series capacity license (VM-300 only), Threat
Prevention license that includes IPS, AV, malware prevention, and
a premium support entitlement.
Bundle 2: Includes the VM-Series capacity license (VM-300
only), Threat Prevention (includes IPS, AV, malware prevention),
GlobalProtect, WildFire, PAN-DB URL Filtering licenses, and a premium
If you have an evaluation copy
of the VM-Series firewall and would like to convert it to a fully licensed
(purchased) copy for the same license type (BYOL to BYOL), you can
deactivate the evaluation license and activate the purchased license
in place. See Upgrade
the VM-Series Firewall for instructions.
You cannot switch between the PAYG and the BYOL licenses. To
move from PAYG to BYOL, contact your Palo Alto Networks channel
partner or sales representative to purchase a BYOL license and get
an BYOL auth code that you can use to license your firewall. If
you have deployed your firewall and want to switch the license, see Switch
Between the BYOL and the PAYG Licenses.