Switch Between VM-Series Licenses

Use this procedure to switch the license of your VM-Series firewall from one type to another, such as a subscription bundle to an ELA.
You can switch the license of your currently-deployed VM-Series firewall, such as moving from a subscription bundle to an enterprise license agreement (ELA) and vice versa, without disrupting traffic moving through the firewall. You can switch the license on an individual firewall or on multiple firewalls simultaneously from Panorama. Complete one of the following procedures to perform one of the following license changes:
  • Subscription bundle 1 to subscription bundle 2
  • Subscription bundle 1 or 2 to an ELA
  • Capacity license to subscription bundle or ELA
Do not use this procedure for PAYG or BOYL. See for Switch Between the BYOL and the PAYG Licenses for more information.
Before switching to an ELA license, you must allocate enough tokens equal the number of currently-deployed VM-Series firewalls. See VM-Series Enterprise License Agreement (Multi-Model ELA) for more information about the tokens required for each VM-Series model.
  • Switch a license on a standalone firewall.
    1. Register your authorization code.
      • For a subscription bundle, register your new authorization code.
      • For an ELA, activate the ELA authorization code.
        Do not use the ELA authorization code to activate individual VM-Series firewalls. After registering your ELA, use the VM-Series model authorization codes to activate individual firewalls. You can find these authorization codes on the Customer Support Portal under
        Assets
        VM-Series Auth-Codes
        .
    2. Log in to the VM-Series firewall web interface.
    3. Verify the Palo Alto Networks update server configuration.
      1. Select
        Device
        Setup
        Services
        .
      2. Confirm that
        Update Server
        is set to updates.paloaltonetworks.com.
      3. Confirm that
        Update Server Identity
        is selected.
    4. Apply a VM-Series authorization code. A firewall authorization code for an ELA begins with the letter A, as shown below.
      license-ela-activate-authcode-highlight.png
      1. Select
        Device
        Licenses
        and select the
        Activate feature using authorization code
        link.
      2. Enter your VM-Series authorization code.
      3. Click
        OK
        to confirm the license upgrade.The firewall contacts the Palo Alto Networks update server and consume the tokens required for your firewall based on the VM-Series model.
      4. Verify the license updated successfully by checking the license expiration date.
    5. Repeat this process for each VM-Series firewall in your deployment.
  • Switch licenses on managed firewalls using Panorama.
    1. Register your authorization code.
      • For a subscription bundle, register your new authorization code.
      • For an ELA, activate the ELA authorization code.
        Do not use the ELA authorization code to activate individual VM-Series firewalls. After registering your ELA, use the VM-Series model authorization codes to activate individual firewalls. You can find these authorization codes on the Customer Support Portal under
        Assets
        VM-Series Auth-Codes
        .
    2. Log in to the Panorama web interface.
    3. Verify the Palo Alto Networks update server configuration for the firewalls.
      1. Select
        Device
        Setup
        Services
        .
      2. Confirm that
        Update Server
        is set to updates.paloaltonetworks.com.
      3. Confirm that
        Update Server Identity
        is selected.
    4. Apply a VM-Series authorization code. A firewall authorization code for an ELA begins with the letter A, as shown below.
      license-ela-activate-authcode-highlight.png
      1. Select
        Panorama
        Device Deployment
        Licenses
        and click
        Activate
        .
      2. Enter your VM-Series authorization code.
      3. Use the filters to select the managed firewalls to be licensed.
      4. Enter your authorization code in the
        Auth Code
        column for each firewall.
      5. Click
        Activate
        to confirm the license upgrade.Panorama contacts the Palo Alto Networks update server and consume the tokens required for your firewalls based on the VM-Series model.
        license-firewalls-from-panorama.png
      6. Verify the license updated successfully by checking the license expiration date.

Related Documentation