How to remove security feature (subscription) from VM-series firewall licensed with Software NGFW Credit?
499
Created On 07/11/24 04:40 AM - Last Modified 10/27/25 21:15 PM
Objective
Remove security feature (subscription) from VM-series firewall licensed with Software NGFW Credit.
Environment
- VM-series firewall.
- PAN-OS version 10.2 or later.
- Licensed with Software NGFW Credit.
- Deployment Profile type is Flexible vCPUs.
Procedure
The VM-series firewall initially has 4 security features licensed: Threat Prevention, URL Filtering, DNS Security, and WildFire. From the screenshot below, DNS Security license was issued on 9th July 2024 and valid until 10th January 2027.
In this article, we are going to remove DNS Security feature from the firewall. We need to edit the Deployment Profile that is used to license the firewall.
Note: Deployment Profile change affects ALL firewalls licensed from the same profile (auth-code).
Follow these steps to remove a security feature from the firewall:
1. Go to Customer Support Portal > Products > Software NGFW Credits.
2. Click Details on the respective Credit Pool ID.
3. Find the Deployment Profile that is used to license the firewall, i.e. KB-profile.
4. Click on the three dots at the right side of the Deployment Profile, then click Edit Profile.
5. New dialog box opens, showing details of the Deployment Profile including the total credit consumed.
6. Uncheck DNS Security, then click Calculate Estimated Cost to see the amount of credit to be released. Click Update Deployment Profile to apply the change.
7. A confirmation dialog box opens, click Yes to continue.
8. Wait for the web page to refresh, then expand the Deployment Profile to verify the change. Total credit consumed is also updated.
9. Login to the firewall GUI and navigate to Device > Licenses. Click Retrieve license keys from license server. Firewall restart is not required.
10. Verify DNS Security license is updated with new issue date (today's date) and expiry date (yesterday's date).