The license deactivation process enables you to self-manage
licenses. Whether you want to remove one or more active licenses
or subscriptions attributed to a firewall (hardware-based or VM-Series
firewall) or you want to deactivate the VM-Series firewall and unassign
all active licenses and subscriptions, begin the deactivation process
on the firewall or Panorama (not on the Palo Alto Networks Customer
Support web site).
To successfully deactivate a license, you must install a license
deactivation API key and enable verification of the update server
identity (enabled by default). PAN-OS uses this deactivation API
key to authenticate with all update a license services. The deactivation
API is key is not required for manual license deactivation, where
there is not connectivity between the firewall and license server.
If the firewall/Panorama has internet access and can communicate
with the Palo Alto Networks Licensing servers, the license removal
process completes automatically with a click of a button. If the
firewall/Panorama does not have internet access, you must complete
the process manually in a two-step process. In the first step, from
the firewall or Panorama, you generate and export a license token
file that includes information on the deactivated keys. In the second step,
while logged in to the Palo Alto Networks Customer Support website,
upload the token file to dissociate the license keys from the firewall.