Deactivate a Feature License or Subscription Using the CLI

Use the CLI to deactivate a fixed model feature license, an ELA license, or a subscription.
If you installed a license/subscription on a firewall and need to reassign it to another firewall, you can deactivate the individual license and re-use the same authorization code on another firewall without help from Technical Support. This capability is supported in the CLI only and is supported on both physical and virtual devices running PAN-OS. This procedure is typically used with fixed-model perpetual or ELA licenses.

Internet Access (Auto Mode)

  1. View the name of the license key for the feature you want to deactivate.
    request license deactivate key features
  2. Deactivate the license or subscription.
    Use the auto mode to remove the license key.
    request license deactivate key features <name> mode auto
    The name is the full name for the license key file. For example:
    admin@vmPAN2> request license deactivate key features <name>
    WildFire_License_2015_01_28_I5820573.key mode auto007200002599 WildFire License Success Successfully removed license keys

No Internet Access (Manual Mode)

Use manual mode to remove the license key and generate a license token for a model-based license. This procedure assumes you have installed the license API key on your firewall.
  1. View the name of the license key for the feature you want to deactivate.
    request license deactivate key features
  2. Deactivate the license manually from the command line.
    request license deactivate key features <name> mode manual
    For example:
    admin@PA-VM> request license deactivate key features
    PAN_DB_URL_Filtering_2015_01_28_I6134084.key mode manual Successfully removed license keys dact_lic.01282015.100502.tok
    The token file uses the format
    dact_lic.timestamp.tok
    , where the timestamp is in the
    dmmyyyy.hrminsec
    format.
  3. Verify that the token file was generated.
    show -token-files
  4. Export the token file.
    Enter this command on a single line:
    scp export license-token-file to <username@serverIP>
    from <token_filename>
    For example:
    scp export license-token-file to admin@10.1.10.55:/tmp/
    from dact_lic.01282015.100502.tok
    1. Click the
      Deactivate License(s)
      link on the
      Assets
      tab.
    2. Select
      Assets
      VM-Series Auth-Codes
      and select
      Deactivate License(s)
      .
    3. Upload the token file to complete the deactivation.

Recommended For You