License Types—VM-Series Firewalls

You can license the VM-Series firewall as a Bring your own license (BYOL), Pay as you go, (PAYG), or with an Enterprise License Agreement (VM-ELA). The PAYG option is the usage-based option that is available on the marketplace for the supported public cloud platforms. The BYOL and VM-Series ELA, are available for any VM-Series firewall. and you can purchase these license types from a partner, reseller, or directly from Palo Alto Networks.
The following licenses and subscriptions are available for the VM-Series firewall:
  • Capacity License—The VM-Series firewall requires a base license, also called a capacity license, to enable the model number (VM-50, VM-100, VM-200, VM300, VM-500, VM-700, or VM-1000-HV) and the associated capacities on the firewall. Capacity licenses are included in a bundle and can be perpetual or term-based:
    • Perpetual License—A license with no expiration date, it allows you to use the VM-Series firewall at the licensed capacity, indefinitely. Perpetual licenses are available for the VM-Series capacity license only.
    • Term-Based License—A term-based license allows you to use the VM-Series firewall for a specified period of time. It has an expiration date and you will be prompted to renew the license before it expires. Term-based licenses are available for the capacity licenses, support entitlements, and subscriptions.
  • Support—In addition to the capacity license, you need a support entitlement that provides access to technical support and software updates. With a license bundle, a premium support entitlement is included. If you need USG support, you must purchase BYOL on AWSGov Cloud and Azure Government.
  • Subscription Bundles—The subscriptions allow you to enforce policies that safely enable applications and content on the network. For example, the Threat Prevention subscription, allows you to obtain content updates that include the most up-to-date threat information for malware detection. You can choose from three license bundles:
    • Basic bundle includes the VM-Series capacity license, and a premium support entitlement.
    • Bundle 1 includes the VM-Series capacity license, Threat Prevention license, and a premium support entitlement.
    • Bundle 2 includes the VM-Series capacity license with the complete suite of licenses that includes Threat Prevention, GlobalProtect, WildFire, PAN-DB URL Filtering, and a premium support entitlement.
      With the license bundles, see Renew VM-Series Firewall License Bundles for renewal options. If you need to add more VM-Series firewalls before the renewal timeline, contact your partner, reseller, or Palo Alto Networks representative.
  • VM-Series ELA—For high-growth enterprises, the VM-Series enterprise licensing agreement (VM-Series ELA) provides a fixed price licensing option that allows up to unlimited deployment of VM-Series firewalls with BYOL. The ELA is offered in one and three-year term agreements with no true-up at the end of the term.
    There are two flavors of the VM-Series ELA:
    • If you purchased the VM-Series ELA before December 4, 2018, you have the legacy VM-Series ELA which includes your choice of a single VM-Series model on any supported hypervisor or public cloud environment. With this ELA, you receive a single license authorization code for capacity, support, GlobalProtect, PAN-DB URL Filtering, Threat Prevention, WildFire subscriptions for every instance of the VM-Series firewall. You also get unlimited deployments of the Panorama virtual appliance included with a device management license for 1000 firewalls on each.
      Palo Alto Networks will begin phasing out the legacy VM-Series ELA on April 16, 2019. Existing enterprise license customers will be notified by their support representative when their account is migrated to the Multi-Model ELA. Licensing tokens will be distributed according to your VM-Series firewall subscription agreement — no additional action is necessary for continued operation of your firewalls. If you would like to Manage VM-Series ELA License Tokens, you must designate an ELA administrator. Only a super user role on the Palo Alto Networks Customer Support Portal (CSP) can assign an ELA administrator.
    • The VM-Series Enterprise License Agreement (Multi-Model ELA) you purchase after December 4, 2018 (either as a new purchase or as a repurchase of the legacy VM-Series ELA) is called the multi-model VM-Series ELA that includes most models of the VM-Series firewall portfolio along with the GlobalProtect, PAN-DB URL Filtering, Threat Prevention, WildFire subscriptions, and support entitlement. You also get unlimited deployments of the Panorama virtual appliance with a device management license for 1000 firewalls on each.

Related Documentation