Focus

VM-Series Deployment Guide

Deactivate a Feature License or Subscription Using the CLI

Table of Contents

Deactivate a Feature License or Subscription Using the CLI

Use the CLI to deactivate a fixed model feature license, an ELA license, or a subscription.

If you installed a license/subscription on a firewall and need to reassign it to another firewall, you can deactivate the individual license and re-use the same authorization code on another firewall without help from Technical Support. This capability is supported in the CLI only and is supported on both physical and virtual devices running PAN-OS. This procedure is typically used with fixed-model perpetual or ELA licenses.

Internet Access (Auto Mode)
No Internet Access (Manual Mode)

Internet Access (Auto Mode)

Log into the CLI on the firewall.
View the name of the license key for the feature you want to deactivate.
request license deactivate key features
Deactivate the license or subscription.
Use the auto mode to remove the license key.
request license deactivate key features <name> mode auto
The name is the full name for the license key file. For example:
admin@vmPAN2> request license deactivate key features <name>
```
WildFire_License_2015_01_28_I5820573.key mode auto007200002599
WildFire License Success
Successfully removed license keys
```

No Internet Access (Manual Mode)

Use manual mode to remove the license key and generate a license token for a model-based license. This procedure assumes you have installed the license API key on your firewall.

Log into the CLI on the firewall.
View the name of the license key for the feature you want to deactivate.
request license deactivate key features
Deactivate the license manually from the command line.
request license deactivate key features <name> mode manual
For example:
admin@PA-VM> request license deactivate key features
```
PAN_DB_URL_Filtering_2015_01_28_I6134084.key mode manual
Successfully removed license keys
dact_lic.01282015.100502.tok
```
The token file uses the format dact_lic.timestamp.tok, where the timestamp is in the dmmyyyy.hrminsec format.
Verify that the token file was generated.
show -token-files
Export the token file.
Enter this command on a single line:
scp export license-token-file to <username@serverIP>
from <token_filename>
For example:
scp export license-token-file to admin@10.1.10.55:/tmp/ from dact_lic.01282015.100502.tok
Log into the Palo Alto Networks Customer Support portal.
1. Click the Deactivate License(s) link on the Assets tab.
2. Select ProductsVM-Series Auth-Codes and select Deactivate License(s).
3. Upload the token file to complete the deactivation.

Deactivate License(s)

Deactivate VM