>
    Strata Copilot
    Troubleshoot License Activation Issues
    Focus
    Download PDF
    Focus
    1. Home
    2. VM-Series
    3. VM-Series Models
    4. Activate VM-Series Model Licenses
    5. Troubleshoot License Activation Issues
    Download PDF
    VM-Series

    Troubleshoot License Activation Issues

    Table of Contents

    Troubleshoot License Activation Issues

    View and resolve common issues with activating your VM-Series firewall license.
    Where Can I Use This?What Do I Need?
    • VM-Series deployment
    • VM-Series 10.x or above
    • Panorama running PAN-OS 10.1.x or above versions
    • Customer Support Portal (CSP) account with one of the following user roles:
      • Superuser, Standard User, Limited User, Threat Researcher, AutoFocus Trial Role, Group superuser, Group Standard User, Group Limited User, Group Threat Researcher, Authorized Support Center (ASC) User, and ASC Full Service User.
      • Superuser access to the VM-Series firewall
    Some of the most common issues with activating your license are covered in this section.

    Error: Insufficient Memory

    Licensing a PA-VM without sufficient memory causes an error similar to the following:
    Server error : failed key check : Resource check failed. 
Memory needed: 6.5GB, allocated memory: 4.8GB
    To fix this problem, provision the additional memory the license requires, and fetch the license with the command.
    1. Provision the additional memory the license requires.
    2. Execute the following command:
      request license fetch
      If you use any other command, it will fail with the following error:
      Server error : failed to fetch license: Cannot apply a provisioning license feature to an already provisioned device.

    Error: Failed to Fetch Licenses

    If you see an error that reads Failed to fetch licenses. Failed to get license info. Please try again later or a generic communications error message displays.
    If you see this error, complete the following verification steps.
    1. Can the firewall route traffic to the Palo Alto Networks server using a service route? By default, the firewall uses the management interface to access the server. If you plan on using a dataplane interface, make sure that you have set up a service route.
    2. Is routing over the internet working? SSH into the firewall and ping a publicly accessible IP address such as 4.2.2.2. Be sure to use the source option if you're using a dataplane interface. For example: ping count 3 source 10.0.1.1 host 4.2.2.2.
    3. Is the DNS set up correctly? SSH into the firewall and ping a DNS name such as google.com. For example:

    Error: Invalid Auth Code

    If you see an error that reads Invalid auth code, complete the following verification steps.
    1. You have entered the auth code properly.
    2. You have registered the auth code to your account on the support portal.
    3. Your auth code has not reached the maximum provisioning capacity for the VM-Series firewalls.
      1. For legacy licenses, log in to the CSP and select AssetsVM-Series Auth-Codes
      2. For Software NGFW Credits, if you know the deployment profile, log in to the CSP and select AssetsSoftware NGFW Credits, locate your profile, and click Details.
        You can also select AssetsSoftware NGFW Devices and search by auth code.

    © 2026 Palo Alto Networks, Inc. All rights reserved.