Palo Alto Networks Knowledgebase: VM-ELA Token Model Overview

VM-ELA Token Model Overview

Created On 07/11/19 07:44 AM - Last Updated 07/16/19 12:09 PM
  • Provide customer access to multiple VM-Series models in a single ELA
  • Allow customer complete flexibility to deploy any VM-Series models during the ELA term
  • Maintain unbounded spirit of ELA while managing abuse.
    • ELAs Bounded and Unbounded Periods will be displayed via a new column.
      • In the Bounded period, there is a limit on the consumption of licenses. We set a 150% growth cap for the first 1.5yrs of 3yr term and first 3yrs of the 5yr term to prevent abuse.
      • In the unbounded period there is no limit on the consumption of licenses. For example, in unbounded period, total tokens would be set at an exaggerated amount of 500,000 + original # of tokens purchased.

NEW CSP Role (ELA-Administrator) was created for the VM-ELA token-based model. The user who activates the VM-ELA auth code will automatically be made the ELA-Admin.
  • Note: New ELA-Administrator role can be added & removed without restrictions by the super user on the account.
  • Note: ELA Admin authority will be automatically granted to an account super user during the first-time authorization of the ELA grandparent auth code via the Enterprise Agreements screen.   
  • Note: ONLY the ELA admin can allocate tokens.
Step 1: Super User - Activate ELA authcode: Assets > Enterprise Agreements
“Activate Enterprise Agreement” button using the new ELA “grandparent auth code” on Enterprise Agreement screen.

User-added image
After Activation:
Automated - ELA is now displayed within the new “Enterprise Agreement: VM-Series” section on the Enterprise Agreement page.
User-added image
Automated - Based on the new logic. Upon activation user is automatically made the ELA Admin for this account.
User-added image

Automated – Upon activation. Two new buttons will appear on the Enterprise Agreements page.
Note: ONLY the ELA-Admin can view and access these buttons.
  • 1. “Grant VM-Series Token” button: Allows the ELA Admin user to add other CSP accounts to the VM-ELA.
    • Note: Email must exist in the CSP portal in order to receive a grant.
    • Note: CSP account user being invited must accept the grant.
  • 2. “Manage VM-Series Token” button: Allows the ELA Admin user to freely allocate tokens across different VM Model capacity licenses for CSP accounts which have been added to the ELA.
User-added image

Automated - “VM-Series Page” now lists all VM’s: Assets > VM-Series Auth-Codes
Note: Quantities show zero as the ELA Admin has not granted tokens to this account yet.
User-added image

Step 2: ELA Admin can grant VM-ELA access to additional CSP accounts (via email address):
Note: Email must exist in the CSP portal in order to receive a grant. Grant VM-Series function can be issued multiple times if need be.

User-added image
Step 3: Account owner confirms grant Email is received in Gmail:

Step 4: Account owner can click the “Review Tokens Grant” and “Agree and Accept” as shown below.
Note: When the user is a member of multiple accounts. The review tokens grant button will continue to display in all the accounts they log into until they accept the grant. If a user mistakenly accepts a grant into the wrong account, they can ask the ELA-Admin to retrigger the grant. SCREEN CHANGE - review tokens grant button will be moved from the Enterprise Agreements screen to the VM-ELA screen in Ph2. We will also add a remove grant option.
User-added image

Automated - Once the grant is accepted the newly added VM ELA CSP account will display in the Enterprise Agreements Screen:
User-added image

Step 5: ELA Admin - Manage VM-Series Token:
ELA Admin can see both CSP accounts in the Drop Down and allocate token accordingly.
Note: Only members with the ELA-Administrator Role can view or use this functionality.

User-added image

ELA Admin can select how many VM’s by model they would like to allocate per account id. The system will automatically calculate the token values for those VM’s. In this example  qty 10- VM-50’s worth 100 tokens & qty 10- VM-500’s worth 1400 tokens have been allocated.
User-added image
Automated - The system will automatically add the 10- VM-50’s & 10- VM-100’s into the selected CSP account “VM-Series” auth code page.
Step 6: Account owner can then register/deactivate the VM’s in the action’s column. (VM quantities & Token counts will be adjusted accordingly.)

User-added image
VM-ELA Adminsite Changes:

  • When doing an entitlement search using the VM ELA grandparent authcode.
    • The system will return the following:
      • CSP ID (All linked CSP accounts)
      • CSP Account Name (All linked CSP accounts)
      • Total Token
      • VM ELA grandparent auth code
        • VM ELA Description
        • VM ELA Expiration Date
        • Associated VM Model Parent Auth Codes with the following information:
          • Model Name
          • Parent Auth Code
          • Quantity Provisioned
          • Max Capacity
    • For large VM accounts there is a new button called “Export to CSV” to Export VM data to CSV which will export:
      • CSP ID
      • CSP Account Name
      • Data association and relationship between:
        • ELA grandparent auth code
        • VM Model Parent Model Name and Auth Code
          • Quantity Provisioned
          • Max Capacity
        • Provisioned VM Serial Numbers and Child Auth Codes
        • Provisioned VM Registration dates and Expiration dates
User-added image
User-added image


  • Print
  • Copy Link