Focus

VM-Series Deployment Guide

Software NGFW Credits

Table of Contents

Software NGFW Credits

Learn about Software NGFW credits, and the licenses they fund.

Software NGFW credits can be used to fund Software NGFWs (VM-Series and CN-Series), Cloud-Delivered Security Services (CDSS), or virtual Panorama appliances in networks with or without internet access (air-gapped networks, for example).

Use Software NGFW Credit Estimator to calculate the number of credits required for your deployment. The Credit Estimator allows you estimate the credits required to license the firewalls and enable the security services needed to secure your deployment.

You create a deployment profile to configure one or more firewalls based on PAN-OS version, the number of vCPUs per firewall, the total number of firewalls supported by the deployment profile, Panorama management or log collection, and security services. All the VMs created with a deployment profile share the same authcode.

Fixed vCPUs—Compatible with all PAN-OS versions. Based on VM-Series Models and security service bundles. Changing the model or service options requires a new license.
Flexible vCPUs—Available on PAN-OS 10.0.4 and later. Select a flexible number of vCPUs, and a flexible selection of security services. You can modify the deployment profile to add or decrease the number of vCPUs, add new services as they become available, or remove services. The maximum number of vCPUs for a deployment profile is 32.

Software NGFW credits are term-based. Terms can be defined for any amount of time between 1 and 5 years. Both allocated and unallocated credits expire at the end of the agreed upon term. You can purchase additional credits for a credit pool but the expiration date must be the same as the target pool.

If you have an internet connection to the license server and you stop using a firewall, a security service, or Panorama deployment, the credits allocated to that resource are refunded to the credit pool and can be reallocated to a new resource.

If you do not have an internet connection and cannot connect to the Palo Alto Networks update server (for example, you are in an air-gapped network) you can manage the VM-Series firewall locally from its user interface, or from Panorama. Your administrator must then log in to the Customer Support Portal to return the license token so the funds can be reused.

Use the Supported Hypervisor table below and the Total vCPUs on Dataplane tables that follow to ensure that you allocate the necessary hardware resources for your chosen number of vCPUs.

Memory Profile	Supported Hypervisors	Minimum Hard Drive
4.5GB, 5.5GB	ESXi, Hyper-V, KVM	32GB (60GB at boot)
6.5GB	AWS, Azure, ESXi, Google Cloud Platform, Hyper-V, KVM, OCI, Alibaba Cloud, Cisco ACI, Cisco CSP, Cisco ENCS, NSX-T	60GB
9GB	AWS, Azure, ESXi, Google Cloud Platform, Hyper-V, KVM, OCI, Alibaba Cloud, Cisco ACI, Cisco CSP, Cisco ENCS, NSX-T	60GB
16GB	AWS, Azure, ESXi, Google Cloud Platform, Hyper-V, KVM, OCI, Alibaba Cloud, Cisco ACI, Cisco CSP, NSX-T	60GB
56GB	AWS, Azure, ESXi, Google Cloud Platform, Hyper-V, KVM, OCI, Alibaba Cloud, Cisco ACI, Cisco CSP, NSX-T	60GB

For all memory profiles listed above, the minimum vCPUs is 2. You can enable Lite mode if you choose 4.5GB. Lite mode is an alternative operating mode for environments where resources are limited. See VM-50 Lite Mode for more information.

Lite mode requires minimum 32GB of hard drive space. However, because the VM-Series base image is common for all vCPU combinations, you must allocate 60GB of hard drive space until you license a VM-Series firewall with 4.5GB memory.

To achieve the best performance, all of the required cores should be available on a single CPU socket.

The distribution of vCPUs assigned to the management plane and the dataplane differs depending on the total number of vCPUs assigned to the VM-Series firewall. Refer to the following table (1-16 vCPUs) to find out the number of dataplane vCPUs automatically allocated for a particular combination of memory profile and total vCPUs. For example, with a memory profile of 16GB and a total of 15 vCPUs, 11 are assigned to the dataplane and the remaining 4 are assigned to the management plane.

Memory Profile	Total vCPUs on Dataplane (1-16)
Memory Profile	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16
4.5GB	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1
5.5GB	1	1	1	1	1	1	1	1	1	1	1	1	1	1	1
6.5GB	1	2	2	2	2	2	2	2	2	2	2	2	2	2	2
9GB	1	2	3	3	4	4	4	4	4	4	4	4	4	4	4
16GB	1	2	3	3	4	5	6	6	7	8	9	9	10	11	12
56GB	1	2	3	3	4	5	6	6	7	8	9	9	10	11	12

Continue to Software NGFW tasks:

Serial Number and CPU ID Format for the VM-Series Firewall

Activate Credits