Focus

VM-Series Deployment Guide

Migrate a Firewall to a Flexible VM-Series License

Table of Contents

Migrate a Firewall to a Flexible VM-Series License

Migrate from a model-based license to flexible Software Next Generation firewall credits.

You can migrate your VM-Series firewall perpetual or ELA license to a flexible VM-Series firewall license (funded using Software NGFW credits).

When you migrate from a perpetual or ELA license, you might need to reboot your firewall to complete the migration. In a fixed vCPU deployment profile, the firewall consumes credits based upon the VM-Series model. After migrating to a deployment profile with fixed vCPUs, each firewall keeps its serial number and does not require a reboot. In a deployment profile with flexible vCPUs, the firewall consumes credits based on the number of vCPUs configured on your source firewall. After migration, you might have to Set the Number of Licensed vCPUs on the firewall to ensure that the expected number of credits are consumed. Setting the number of licensed vCPUs requires you to reboot your firewall.

Check and set the number of licensed vCPUs before the migration if you get an error message stating that you do not have enough credits in the deployment profile to support the request.

If your VM-Series firewalls are deployed in a production environment, it is recommended that you perform the migration during a maintenance window.

Complete one of the following procedures to migrate your licenses.

Standalone Firewall with Access to the CSP
Verify the Migration

Standalone Firewall with Access to the CSP

This process does not disrupt traffic moving through the firewall.

Log in to the VM-Series firewall web interface.
Verify the Palo Alto Networks update server configuration.
1. Select DeviceSetupServices.
2. Confirm that Update Server is set to updates.paloaltonetworks.com.
3. Confirm that Verify Update Server Identity is selected.
Log in to the CSP and Create a Deployment Profile.

You will use the auth code from this profile. An auth code for a flexible firewall license begins with the letter D, as shown below.
Log into your VM-Series firewall.
Install a License API Key.
Apply the VM-Series authorization code from the new deployment profile.
1. Select DeviceLicenses.
  
  If the current VM-Series model and the VM-Series model you are migrating to are different, select the Upgrade VM Capacity link.
  
  If the VM-Series model is the same before and after migration, select the Activate feature using authorization code link.
2. Enter the VM-Series authorization code from the new deployment profile.
3. Click OK to confirm the license upgrade. The firewall contacts the Palo Alto Networks update server and consumes the tokens required for your firewall based on the VM-Series model.
If you are migrating to a deployment profile with flexible vCPUs, you might have to set the number vCPUs used by your firewall. Setting the number of licensed vCPUs requires you to reboot your VM-Series firewall for this change to take effect.
1. Determine if your VM-Series firewall requires fewer vCPUs than the number of available vCPUs on your compute instance.
2. Set the Number of Licensed vCPUs.
(Optional) Verify the Migration.
Repeat this process for each VM-Series firewall in your deployment.

Verify the Migration

Verify that your license migration was successful.

On the device, check the license expiration date to verify the license updated successfully.
Verify that all subscriptions enabled in your deployment profile are applied to your device.
On the CSP, verify that the expected number of credits allocated and credits consumed match your credit pool.
On the CSP, verify that the associated tokens or quantity of licenses have been returned to your previous auth code.

Customize Dataplane Cores

Software NGFW Licensing API