: Deactivate a Feature License or Subscription Using the CLI
Focus
Focus

Deactivate a Feature License or Subscription Using the CLI

Table of Contents
End-of-Life (EoL)

Deactivate a Feature License or Subscription Using the CLI

Use the CLI to deactivate a fixed model feature license, an ELA license, or a subscription.
If you installed a license/subscription on a firewall and need to reassign it to another firewall, you can deactivate the individual license and re-use the same authorization code on another firewall without help from Technical Support. This capability is supported in the CLI only and is supported on both physical and virtual devices running PAN-OS. This procedure is typically used with fixed-model perpetual or ELA licenses.

Internet Access (Auto Mode)

  1. Log into the CLI on the firewall.
  2. View the name of the license key for the feature you want to deactivate.
    request license deactivate key features
  3. Deactivate the license or subscription.
    Use the auto mode to remove the license key.
    request license deactivate key features <name> mode auto
    The name is the full name for the license key file. For example:
    admin@vmPAN2> request license deactivate key features <name>
    WildFire_License_2015_01_28_I5820573.key mode auto007200002599
    WildFire License Success
    Successfully removed license keys

No Internet Access (Manual Mode)

Use manual mode to remove the license key and generate a license token for a model-based license. This procedure assumes you have installed the license API key on your firewall.
  1. Log into the CLI on the firewall.
  2. View the name of the license key for the feature you want to deactivate.
    request license deactivate key features
  3. Deactivate the license manually from the command line.
    request license deactivate key features <name> mode manual
    For example:
    admin@PA-VM> request license deactivate key features
    PAN_DB_URL_Filtering_2015_01_28_I6134084.key mode manual
    Successfully removed license keys
    dact_lic.01282015.100502.tok
    The token file uses the format dact_lic.timestamp.tok, where the timestamp is in the dmmyyyy.hrminsec format.
  4. Verify that the token file was generated.
    show -token-files
  5. Export the token file.
    Enter this command on a single line:
    scp export license-token-file to <username@serverIP>
    from <token_filename>
    For example:
    scp export license-token-file to admin@10.1.10.55:/tmp/ from dact_lic.01282015.100502.tok
  6. Log into the Palo Alto Networks Customer Support portal.
    1. Click the Deactivate License(s) link on the Assets tab.
    2. Select ProductsVM-Series Auth-Codes and select Deactivate License(s).
    3. Upload the token file to complete the deactivation.