>
    Strata Copilot
    Switch Between the BYOL and the PAYG Licenses
    Focus
    Download PDF
    Focus
    1. Home
    2. VM-Series
    3. VM-Series Models
    4. Switch Between the BYOL and the PAYG Licenses
    Download PDF
    VM-Series

    Switch Between the BYOL and the PAYG Licenses

    Table of Contents

    Switch Between the BYOL and the PAYG Licenses

    VM-Series firewall cannot be converted between the BYOL and PAYG licensing options.
    Where Can I Use This?What Do I Need?
    • VM-Series deployment
    • VM-Series 10.x or above
    • Panorama running PAN-OS 10.1.x or above versions
    • Customer Support Portal (CSP) account with one of the following user roles:
      • Superuser, Standard User, Limited User, Threat Researcher, AutoFocus Trial Role, Group superuser, Group Standard User, Group Limited User, Group Threat Researcher, Authorized Support Center (ASC) User, and ASC Full Service User.
      • Superuser access to the VM-Series firewall
    The VM-Series firewall cannot be converted between the BYOL and PAYG licensing options. If you have already deployed and configured a VM-Series firewall with the PAYG or BYOL option in AWS, Azure, or Google Cloud Platform, and now want to switch to the other option, use the following instructions to save and export the configuration on your existing firewall, deploy a new firewall, and then restore the configuration on the new firewall.
    1. Save a backup of the current configuration file and store it to an external server.
      1. Select DeviceSetupOperations and Export named configuration snapshot.
      2. Select the XML file that contains your running configuration (for example, running-config.xml) and click OK to export the configuration file.
      3. Save the exported file to a location external to the firewall.
    2. Deploy a new firewall and register or activate the license, as appropriate.
      For a new PAYG instance:
      1. In the AWS, Azure, or Google Cloud Platform Marketplace, select the software image for the PAYG licensing bundle you want to deploy.
      2. Deploy a new VM-Series firewall in your public cloud of choice.
      3. Register the Usage-Based Model of the VM-Series Firewall for Public Clouds (no auth code).
      For a new BYOL instance:
      1. Contact your sales representative or reseller to purchase a BYOL license, and get a BYOL auth code that you can use to license your firewall.
      2. Register the VM-Series Firewall (with auth code).
      3. Deploy a new VM-Series firewall in your public cloud of choice.
      4. Activate the License for the VM-Series Firewall (Standalone Version).
    3. On the newly deployed firewall, restore the configuration that you exported.
      1. Access the web interface of the newly deployed firewall.
      2. Select DeviceSetupOperations, click Import named configuration snapshot, Browse to the configuration file on the external host, and click OK.
      3. Click Load named configuration snapshot, select the Name of the configuration file you just imported, and click OK.
      4. Click Commit to overwrite the running configuration with the snapshot you just imported.
      5. Verify that the configuration on the new firewall matches the firewall that you are replacing, before you delete the firewall or deactivate the licenses on the replaced firewall.

    © 2026 Palo Alto Networks, Inc. All rights reserved.