Focus

VM-Series Deployment Guide

Upgrade the VM-Series Model

Table of Contents

Upgrade the VM-Series Model

The VM-Series firewall licensing process uses the UUID and CPU ID to generate a unique serial number for a firewall. When you generate a license, it is mapped to a specific instance of the VM-Series firewall and cannot be modified. See VM-Series Firewall Licensing for an overview of the license types and consumption models.

Use the instructions in this section if you want to:

Migrate from a evaluation capacity license to a production license.
Upgrade the model to increase capacity. For example, you want to upgrade from the VM-100 to the VM-300 model, or change the instance type or VM type for your hypervisor.
- Upgrading capacity restarts some critical processes on the firewall.
- If your firewall is licensed with the BYOL option, you must deactivate your VM before you change the model. If you do not, your license is invalidated because a new UUID and CPU ID are assigned when the model changes. After you complete the capacity upgrade, a license for the new capacity must be applied.
- If you have an HA configuration, see Upgrade the VM-Series Model in an HA Pair.

You can use a VM-Series Model, but fund the license with Software NGFW credits. For that procedure, see

Allocate additional hardware resources to your VM-Series firewall.
Before initiating the capacity upgrade, you must verify that enough hardware resources are available to the VM-Series firewall to support the new capacity. The process for assigning additional hardware resources differs on each hypervisor.
To check the hardware requirements for your new VM-Series model, see VM-Series Models.
Although the capacity upgrade does not require a reboot of the VM-Series firewall, you need to power down the virtual machine to change the hardware allocation.
Retrieve the license deactivation API key from the Customer Support portal.
1. Log in to the Customer Support Portal.
  
  Make sure that you are using the same account that you used to register the initial license.
2. From the menu on the left, select AssetsAPI Key Management.
3. Copy the API key.
On the firewall, use the CLI to install the API key copied in the previous step.
request license api-key set key <key>
Enable the firewall to Verify Update Server identity on DeviceSetupService.
Commit your changes. Ensure that you have a locally-configured user on the firewall. Panorama pushed users might not be available after the deactivation if the configuration exceeds the non-licensed PA-VM objects limit.
Upgrade the capacity.
Select DeviceLicensesUpgrade VM Capacity and then activate your licenses and subscriptions in one of the following ways:
- Retrieve license keys from license server—Use this option if you activated your license on the Customer Support portal.
- Manually upload license key—Use this option if your firewall does not have connectivity to the Customer Support portal. In this case, you must download a license key file from the support site on an Internet connected computer and then upload to the firewall.
- Use an authorization code—Use this option to upgrade the VM-Series capacity using an authorization code for licenses that have not been previously activated on the support portal. When prompted, enter the Authorization Code and then click OK.
Verify that your firewall is licensed successfully.
On the DeviceLicenses page, verify that the license was successfully activated.

Upgrade the VM-Series for NSX Without Disrupting Traffic

Upgrade the VM-Series Model in an HA Pair