DotW: Deactivating and Showing Licenses (CLI Commands)

DotW: Deactivating and Showing Licenses (CLI Commands)

77188
Created On 09/25/18 18:55 PM - Last Modified 09/15/20 16:47 PM


Symptom


This week's Discussion of the Week (DotW) covers licenses, how to check and deactivate them.

Community member Transporter posted a question in the General Topics area:
2016-07-18_lic1.png

Link to the discussion here:
https://live.paloaltonetworks.com/t5/General-Topics/Deactivate-the-Licenses/m-p/97718#U97718

Our member asked about deactivating the licenses on a Palo Alto Networks device, and what would happen to the licences.

  • Does deactivating a license on the box mean that the time stops on the box?
  • If reactivated later, do the licenses become active from the deactivation time/period?
  • Can auth codes  be activated on the same device/boxes?
  • When will the licenses actually become active/valid for the new Palo Alto Networks install?


Licensing is something that can be confusing at times, which is why I wanted to give you the answer, as well as more information on how to check to see what licenses you have via the CLI, and commands to deactivate specific licenses installed on the Palo Alto Networks device.



Environment


  • Licensing


Resolution


You can delete the license from your device but the clock will keep counting.

Information on grace periods can be found here, with examples:
https://www.paloaltonetworks.com/services/support/support-policies/grace-period

The support license, for example, has a 30-day grace period:
If a hardware platform is shipped on January 1, 2011, then the start date for support will actually be January 31, 2011 (30 days after initial ship date), or earlier if the hardware device was activated before January 31, 2011.

Now that Transporter's question was answered, please allow me to expand on this common question about showing the licenses installed, and deactivating licenses via the CLI.

The CLI command to show which licenses are currently installed is:

> request license info


Current GMT Date: July 18, 2016

License entry:
Feature: WildFire License
Description: WildFire signature feed, integrated WildFire logs, WildFire API
Serial: 0009C10xxxx
Issued: March 26, 2015
Expires: September 04, 2017
Expired?: no

License entry:
Feature: Threat Prevention
Description: Antivirus, anti-spyware, vulnerability protection
Serial: 0009C10xxxx
Issued: March 26, 2015
Expires: September 04, 2017
Expired?: no

License entry:
Feature: PAN-DB URL Filtering
Description: Palo Alto Networks URL Filtering License
Serial: 0009C10xxxx
Issued: March 26, 2015
Expires: September 04, 2017
Expired?: no

<results trucated>
 

In fact, there are more options for licenses in the CLI: deactivate, fetch, info, and install.

> request license
  > deactivate deactivate licenses
  > fetch Get new license(s) using an authentication code
  > info Show information about owned license(s)
  > install Install a license key


If there is a specific license that you want to deactivate, you can use the following command to list the current license keys installed:

> request license deactivate key features
[                                                Start a list of values.
AutoFocus_Device_License_2016_04_26_S1782944.key 2016/04/27 01:17:11   0.3K
AutoFocus_Device_License_2016_06_15_S4740206.key 2016/06/16 01:13:24   0.3K
GlobalProtect_Gateway_2015_03_26.key             2015/10/12 05:43:59   0.3K
PAN_DB_URL_Filtering_2015_03_26.key              2015/10/12 05:43:59   0.3K
Threat_Prevention_2015_03_26.key                 2015/10/12 05:43:59   0.3K
WildFire_License_2015_03_26.key                  2015/10/12 05:43:59   0.3K
<value>                                          member value
 

Then continue with that same command to deactivate a specific license key, say the last WildFire license.

> request license deactivate key features WildFire_License_2015_03_26.key
 

Another command that can come in handy is to show which support license the unit has installed on it.  This information can be found by typing in the following command:

> request support info

Support Home
https://support.paloaltonetworks.com
Manage Cases
https://support.paloaltonetworks.com/pa-portal/index.php?option=com_pan&task=viewcases&Itemid=
100
866-898-9087
support@paloaltonetworks.com
September 04, 2017
Standard
10 x 5 phone support; repair and replace hardware service
 

This command is very helpful to show not only the level of support this device has, which is Standard Support, but that it expires on the unit in September 2017.



Additional Information


For step-by-step instructions for performing VM license deactivation, please see the detailed steps in the 7.1 admin guide  here:

License the VM-Series Firewall



Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRPCA0&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language