To license the firewall during the bootstrapping
process, you must purchase the auth codes, activate the auth codes,
and register the licenses and subscriptions on the Palo Alto Networks
Support portal before you begin bootstrapping.
For the VM-Series
firewalls running BYOL (not applicable for usage-based licensing—PAYG),
you must have an auth code bundle that includes the capacity auth
code, support subscription, and any other subscriptions you require.
The process of preparing the licenses for bootstrapping depends
on whether the firewall has direct internet access when bootstrapping:
Direct internet access—The VM-Series firewall is connected
directly to the internet.
Airgapped environment or no direct internet access— If the
firewall does not have direct internet access, you can either:
Manually register the VM-Series firewall and download the
license keys from the Palo Alto Networks Support portal.
Use an orchestration service or a custom script to register
the VM-Series firewall and fetch the license keys.
For a custom script or an orchestration service that
can automate the manual process described above.
The script or service must fetch the CPU ID and the UUID
from the hypervisor on which the firewall is deployed and access
the Palo Alto Networks Support portal with CPU ID, UUID, API key
and the auth code to obtain the required license keys. See Licensing API.