>
    Strata Copilot
    Deactivate License (Software NGFW Credits)
    Focus
    Download PDF
    Focus
    1. Home
    2. VM-Series
    3. Software NGFW Credits
    4. Deactivate License (Software NGFW Credits)
    Download PDF
    VM-Series

    Deactivate License (Software NGFW Credits)

    Table of Contents

    Deactivate License (Software NGFW Credits)

    Deactivate a license before you delete a firewall from the CSP Software NGFW credits deployment profile.
    Where Can I Use This?What Do I Need?
    • VM-Series deployment
    • VM-Series 10.x or above
    • Panorama running PAN-OS 10.1.x or above versions
    • Customer Support Portal (CSP) account with one of the following user roles:
      • Super User, Standard User, Limited User, Threat Researcher, AutoFocus Trial Role, Group Super User, Group Standard User, Group Limited User, Group Threat Researcher, Authorized Support Center (ASC) User, and ASC Full Service User.
      • Superuser access to the VM-Series firewall
    Deactivate any licenses from the CSP before you delete a firewall (or the VM hosting the firewall) or the license credits can’t return to your credit pool.
    When you have internet access to the licensing server, deactivating the firewall on the CSP automatically removes the licenses, and the remaining credits are returned to the deployment profile. After you deactivate the license you must delete the firewall, or it will continue to consume credits.
    If you don’t have internet access, you must export the license token from the firewall. Then, in the CSP, start deactivation and upload the token (or paste in the token text) to complete the deactivation.
    • Direct internet access.
      1. Select ProductsAssetsSoftware NGFW Credits and click the Details button on the credit pool you used to create your deployment profile.
      2. Locate your deployment profile, and on the far right, select the vertical ellipsis (More Options) and select Deactivate Firewall.
      3. Check the firewall you want to deactivate, and select Deactivate Firewall.
    • No internet access.
      1. Log in to the firewall web interface and select DeviceLicenses.
      2. In the License Management section, select Deactivate VM.
        Verify the list of licenses/entitlements to be deactivated on the firewall.
      3. Select Complete Manually to start the deactivation.
        Click the Export license token link to save the token file to the client. A token filename looks like this: 20150128_1307_dact_lic.01282015.130737.tok
        At this point the license has been deactivated on the firewall, but the credits have not been returned to the credit pool.
      4. Use the token file to register the changes with the Licensing server:
        1. Log in to the Palo Alto Networks Customer Support website.
        2. Select ProductsVM-Series Auth-CodesDeactivate License(s).
        In the Deactivate Licenses form, paste in the token text, or copy the token to a computer with internet access and upload the token file to the CSP to complete license removal.
      5. Delete the VM.
    • No internet access—Panorama management
      1. Log in to the Panorama web interface and select PanoramaDevice DeploymentLicenses.
      2. Select Deactivate VMs and select the VM-Series firewall that you want to deactivate.
      3. Select Complete Manually to export the token file.
      4. Click the Export license token link to save the token file. A token filename looks like this: 20150128_1307_dact_lic.01282015.130737.tok
        If the export is successful, a completion message is displayed, and the firewall reboots automatically.
      5. Use the token file to register the changes with the licensing server.
        1. Log in to the Palo Alto Networks Customer Support website.
        2. Select ProductsVM-Series Auth-CodesDeactivate License(s).
        In the Deactivate Licenses form, paste in the token text, or copy the token to a computer with internet access and upload the token file to the CSP to complete license removal.
      6. (optional) Remove the deactivated VM-Series firewall as a managed device on Panorama.
        Instead of deleting the deactivated firewalls, you can create a separate device group and assign them to it.
        1. Select PanoramaManaged Devices.
        2. Select the firewall that you deactivated and click Delete.

    © 2026 Palo Alto Networks, Inc. All rights reserved.