FLEX Licensing failure with lack of credit for VM-Series under ... - Knowledge Base - Palo Alto Networks

FLEX Licensing failure with lack of credit for VM-Series under OCI environment

17590

Created On 08/12/21 17:43 PM - Last Modified 02/07/22 18:42 PM

Oracle Cloud Infrastructure

Deployment

8.1

9.0

9.1

10.0

10.1

PAN-OS

VM-Series

Symptom

VM-Series Firewall was deployed with VM.Standard2.4 having 4 Intel Flexible OCPU

To match the physical CPU allocated FLEX license profile was created with 4 vCPU

However, upon FLEX license registration encountering an error showing lack of FLEX credits

FLEX license registration only completes with 8 vCPU allocated

Environment

VM-Series Firewall appliances under Oracle Cloud Infrastructure (OCI)

Cause

Intel Flexible OCPU used under OCI is hyper-threaded by default. When Intel® Hyper-Threading Technology is active, the CPU exposes two execution contexts per physical core meaning one physical core now works like two “logical cores” that can handle different software threads.

https://www.intel.com/content/www/us/en/gaming/resources/hyper-threading.html

For VM.Standard2.8 with 8 OCPU allocated under OCI

PA-VM detects 16 as usable cores as it counts the total number of logical cores.

admin@PA-VM> show system state | match cfg.platform
cfg.platform.cores: 16
cfg.platform.cpuid: KVM:<removed>
cfg.platform.dp-cores: 6
cfg.platform.dp-slots: 1
cfg.platform.family: vm
cfg.platform.lic-cap: VM-500

Resolution

Increase the vCPU to reflect the number of logical core counts (OCPU # x 2) when creating the FLEX license to register the PA-VM under OCI.
Or create a Fixed vCPU model profile and choose the model you are planning to deploy.

Additional Information

Workaround:

Use the Fixed Model licensing type to manually select the Firewall Model to allocate the desired DP CPU: