Prepare the Licenses for Bootstrapping

To license the firewall during the bootstrapping process, you must purchase the auth codes, activate the auth codes, and register the licenses and subscriptions on the Palo Alto Networks Support portal before you begin bootstrapping.
For the VM-Series firewalls running BYOL (not applicable for usage-based licensing—PAYG), you must have an auth code bundle that includes the capacity auth code, support subscription, and any other subscriptions you require. The process of preparing the licenses for bootstrapping depends on whether the firewall has direct internet access when bootstrapping:
  • Direct internet access—The VM-Series firewall is connected directly to the internet.
  • Airgapped environment or no direct internet access— If the firewall does not have direct internet access, you can either:
    • Manually register the VM-Series firewall and download the license keys from the Palo Alto Networks Support portal.
    • Use an orchestration service or a custom script to register the VM-Series firewall and fetch the license keys.
  • For VM-Series firewalls with Internet access.
    Enter the auth code in the /license folder when you Prepare the Bootstrap Package.
  • For VM-Series firewalls without direct internet access.
    1. Activate the VM-Series auth code and register the firewall.
      Go to, and follow the steps to Register the VM-Series Firewall (with auth code).
    2. Download the license keys and save it to a local folder.
      1. Select
        and filter for your record using the model name or auth code.
      2. Download the keys for the firewall and the subscriptions in your bundle.
    3. Continue to Prepare the Bootstrap Package; you must add the license keys that you downloaded to the
      folder in the bootstrap package.
  • For a custom script or an orchestration service that can automate the manual process described above.
    The script or service must fetch the CPU ID and the UUID from the hypervisor on which the firewall is deployed and access the Palo Alto Networks Support portal with CPU ID, UUID, API key and the auth code to obtain the required license keys. See Licensing API.

Recommended For You