Deactivate a Feature License or Subscription Using the CLI

If you accidentally installed a license/subscription on a firewall and need to reassign the license to another firewall, you can deactivate an individual license and re-use the same authorization code on another firewall without help from Technical Support. This capability is supported on the CLI only; this process is supported both on the hardware-based firewalls and on the VM-Series firewall.
  1. (
    Direct internet access only
    ) View the name of the license key file for the feature you want to deactivate.
    request license deactivate key features ?
  2. (
    Direct internet access only
    ) Deactivate the license or subscription.
    request license deactivate key features
    <name>
    mode auto
    where, name is the full name for the license key file.
    For example:
    admin@vmPAN2>
    request license deactivate key features WildFire_License_2015_01_28_I5820573.key mode auto007200002599
    WildFire License Success
    Successfully removed license keys
  3. (
    When there is no direct internet access
    ) View the name of the license key file for the feature you want to deactivate.
    request license deactivate key features
  4. (
    When there is no direct internet access
    ) Deactivate the license manually.
    request license deactivate key features
    <name>
    mode manual
    For example:
    admin@PA-VM>
    request license deactivate key features PAN_DB_URL_Filtering_2015_01_28_I6134084.key mode manual
    Successfully removed license keys
    dact_lic.01282015.100502.tok
    The token file uses the format
    dact_lic.timestamp.tok,
    where the timestamp is in the
    dmmyyyy.hrminsec
    format.
  5. Verify that the token file was generated.
    show license-token-files
  6. Export the token file to an SCP or TFTP server and save it to your computer.
    scp export license-token-file to
    <username@serverIP>
    from
    <token_filename>
    For example:
    scp export license-token-file to admin@10.1.10.55:/tmp/ from dact_lic.01282015.100502.tok
  7. Click the
    Deactivate License(s)
    link on the
    Assets
    tab.
  8. Select
    Assets
    VM-Series Auth-Codes
    Deactivate License(s)
    .
  9. While logged in to the Palo Alto Networks Customer Support website, upload the token file to complete the deactivation.
    Token_file_upload.PNG

Related Documentation