Learn about BYOL and PAYG licenses for public cloud marketplaces.
The VM-Series firewall licensing strategy is the same
for AWS, Azure, and Google Cloud Platform. There are different license
types (see License
Types—VM-Series Firewalls), and Bring Your Own License and
Pay-as-you-go licensing methods:
Bring Your Own License (BYOL)
—A license that is
purchased from a partner, reseller, or directly from Palo Alto Networks.
BYOL supports individual capacity licenses, support licenses, and
For individual BYOL licenses,
you must apply the auth code after you deploy the VM-Series firewall.
A BYOL license bundle has a single auth code you can include
in the bootstrap package (see Bootstrap
the VM-Series Firewall). All the subscriptions included in
the bundle are licensed when the firewall launches.
the PAYG license bundles, the firewall is prelicensed and ready
for use as soon as you deploy it; you do not receive an auth code.
When you stop or terminate the firewall from your Cloud console,
PAYG licenses are suspended or terminated. The PAYG licenses are
bundled as follows:
VM-Series firewall capacity license
Threat Prevention (AV, IPS, and malware prevention)
PAN-DB URL Filtering
You cannot switch between the PAYG and the BYOL licenses. To
move from PAYG to BYOL, contact your Palo Alto Networks channel
partner or sales representative to purchase a BYOL license and get
a BYOL auth code that you can use to license your firewall. If you
have deployed your firewall and want to switch the license, see Switch
Between the BYOL and the PAYG Licenses.
If you have an evaluation copy of the VM-Series firewall
and would like to convert it to a fully licensed (purchased) copy
for the same license type (BYOL to BYOL), you can deactivate the
evaluation license and activate the purchased license in its place.
the VM-Series Firewall for instructions.