License Types—VM-Series Firewalls
The following licenses and subscriptions are available for the VM-Series firewall:
Capacity License —The VM-Series firewall requires a base license, also called a capacity license, to enable the model number (VM-100, VM-200, VM300, VM-1000-HV) and the associated capacities on the firewall. Capacity licenses can be perpetual or term-based: Perpetual License —A license with no expiration date, it allows you to use the VM-Series firewall at the licensed capacity, indefinitely. Perpetual licenses are available for the VM-Series capacity license only. Term-Based License —A term-based license allows you to use the VM-Series firewall for a specified period of time. It has an expiration date and you will be prompted to renew the license before it expires. Term-based licenses are available for the capacity licenses, support entitlements, and subscriptions.
Further, capacity licenses are available as an Individual version or an Enterprise version. The Individual version is in multiples of 1. The orderable SKU, for example PA-VM-300, includes an auth code to license one instance of the VM-Series firewall. The Enterprise version is available in multiples of 25. For example, the orderable SKU PAN-VM-100-ENT has a single auth code that allows you to register 25 instances of the VM-100.
Support—In addition to the capacity license, you need a support entitlement that provides access to technical support and software updates. Subscriptions—Optionally, you may purchase one or more subscription licenses for Threat Prevention, URL Filtering, AutoFocus, GlobalProtect, and WildFire. These subscriptions allow you to enforce policies that safely enable applications and content on the network. For example, the Threat Prevention subscription, allows you to obtain content updates that include the most up-to-date threat information for malware detection.
VM-Series NSX Edition Firewall Licenses
In order to automate the provisioning and licensing of the VM-Series NSX Edition firewall in the VMware integrated NSX solution, two license bundles are available:
One bundle includes the VM-Series capacity license (VM-1000-HV only), Threat Prevention license and a premium support entitlement. Another bundle includes the VM-Series capacity license (VM-1000-HV only) with the complete suite of licenses that include Threat Prevention, GlobalProtect, WildFire, PAN-DB URL Filtering, and a premium support entitlement.
VM-Series Firewall in Amazon Web Services (AWS) and Azure Licenses
You can license the VM-Series firewall in AWS and Azure in two ways:
Bring Your Own License (BYOL) —A license that is purchased from a partner, reseller, or directly from Palo Alto Networks. Capacity license, support license, and subscription licenses are supported for BYOL. With this option, you must apply the license after you deploy the VM-Series firewall. Usage-Based License —Also called a pay-per-use or pay-as-you-go (PAYG) license. This type of license can be purchased from the AWS Marketplace and the Azure public Marketplace. Usage-based licenses are not available on Azure Government Cloud.
AWS supports hourly and annual PAYG options; Azure public Marketplace supports the hourly PAYG option only.
For usage-based models of the VM-Series firewall in AWS, the longer AWS instance IDs are not supported; use the shorter 8‐character instance ID format.
With the usage-based licenses, the firewall is prelicensed and ready for use as soon as you deploy it; you do not receive an auth code. When the firewall is stopped or terminated on the AWS or Azure console, the usage-based licenses are suspended or terminated.
Usage-based licenses are available in the following pricing bundles:
Bundle 1: Includes the VM-Series capacity license (VM-300 only), Threat Prevention license that includes IPS, AV, malware prevention, and a premium support entitlement. Bundle 2: Includes the VM-Series capacity license (VM-300 only), Threat Prevention (includes IPS, AV, malware prevention), GlobalProtect, WildFire, PAN-DB URL Filtering licenses, and a premium support entitlement.
If you have an evaluation copy of the VM-Series firewall and would like to convert it to a fully licensed (purchased) copy, clone your VM-Series firewall and use the instructions to register and license the purchased copy of your VM-Series firewall. For instructions, see Upgrade the VM-Series Firewall.
You cannot switch between the PAYG and the BYOL licenses. To move from PAYG to BYOL, contact your Palo Alto Networks channel partner or sales representative to purchase a BYOL license and get an BYOL auth code that you can use to license your firewall. If you have deployed your firewall and want to switch the license, see Switch Between the BYOL and the PAYG Licenses.

Related Documentation