PAN-OS: Managing Firewall Configurations within Panorama - Licensing

PCNSE Objective Focus (Domain 4 - 18%)

4.3 Manage firewall configurations within Panorama

Introduction: Centralized License Management

Panorama not only centralizes policy and configuration management but also provides capabilities for managing licenses across your fleet of managed firewalls. This simplifies the process of activating, deactivating, and tracking the status of various licenses and subscriptions required for different firewall features.

Understanding how Panorama handles licensing is important for ensuring firewalls have the necessary subscriptions enabled to perform their security functions effectively.

While Panorama helps *manage* and *deploy* licenses, the initial purchase and registration of licenses against specific firewall serial numbers typically still occurs via the Palo Alto Networks Customer Support Portal (CSP).

License Types Managed via Panorama

Panorama can interact with and manage various license types for its managed firewalls:

Panorama Licensing Management Workflow

Panorama provides several ways to manage licenses for connected firewalls:

  1. Viewing License Status:

    • Location: Panorama > Managed Devices > Licenses
    • Functionality: Provides a centralized view of the license status for all firewalls currently connected to Panorama. You can see which licenses/subscriptions are active, expired, or missing for each device.
    • Use Case: Quickly assess the license compliance and activation status across the entire managed firewall estate.

  2. Retrieving/Fetching Licenses from the License Server:

    • Location: Panorama > Licenses (or sometimes via Panorama > Managed Devices > Licenses depending on version/context)
    • Functionality: Allows Panorama to connect to the Palo Alto Networks license server (requires Panorama to have internet connectivity, potentially via Service Routes) and retrieve license keys that have been activated for the managed firewalls in the Customer Support Portal (CSP).
    • Use Case: Activating newly purchased licenses or refreshing existing ones without needing to log into each firewall individually. Panorama fetches the keys associated with the serial numbers it manages.
    • The initial activation (associating a purchased license code with a serial number) still happens in the CSP. Panorama retrieves the *activated* license key file.

  3. Deploying/Pushing Licenses to Firewalls:

    • Location: Typically initiated after retrieving licenses, often from Panorama > Licenses or as part of a commit/push operation.
    • Functionality: Panorama pushes the retrieved license key files down to the corresponding managed firewalls.
    • Mechanism: License keys are deployed as part of the configuration push process.
    • Use Case: Installing the activated licenses onto the firewalls so they can enable the licensed features.

  4. Deactivating Licenses (Less Common via Panorama):

    • Deactivation (e.g., when decommissioning a firewall) is usually performed via the Customer Support Portal (CSP) to free up the license for use on another device. Panorama primarily focuses on retrieval and deployment of *active* licenses.

  5. Managing VM-Series Licenses:

    • Panorama is often used as the license server for capacity-based VM-Series deployments (e.g., Software NGFW Credits, CPU-based licenses).
    • Panorama manages the pool of licenses and allocates them to managed VM-Series firewalls as they boot up or based on configuration. 
graph TD
    A[1. Purchase and Activate License CSP Portal]
    B[2. Panorama Retrieves License Panorama Licenses]
    C[3. Panorama Pushes License via Commit and Push]
    D[4. Firewall Installs License]
    E[5. Feature Enabled on Firewall]

    A -- Activation Info --> PaloAltoLicensingServer
    PaloAltoLicensingServer -- License Key --> B
    B --> C
    C --> D
    D --> E

    style A fill:#fdebd0,stroke:#f5b041
    style B fill:#eaf2f8,stroke:#aed6f1
    style C fill:#eaf2f8,stroke:#aed6f1
    style D fill:#e9ecef,stroke:#adb5bd
    style E fill:#d5f5e3,stroke:#58d68d
Simplified License Activation and Deployment Flow via Panorama.

Best Practices for License Management with Panorama

Caveats and Considerations

PCNSE Exam Focus

For the PCNSE exam, understand:

Panorama Licensing Quiz

1. What is the primary benefit of using Panorama to manage firewall licenses?

Panorama simplifies management by allowing administrators to view status, retrieve activated licenses, and push them to managed devices from a single console, rather than managing each firewall individually.

2. Where in the Panorama GUI would you primarily go to view the current license status (active, expired) for all managed firewalls?

The 'Managed Devices > Licenses' tab provides a consolidated inventory view of the license status for each firewall connected to and managed by Panorama.

3. What action must typically be performed FIRST before Panorama can retrieve and deploy a new subscription license (e.g., Threat Prevention) for a specific firewall?

Panorama retrieves license keys based on what's activated in the CSP. The license must first be purchased and activated against the specific device serial number in the CSP before Panorama can fetch it.

4. What is the function of the "Retrieve license keys from license server" option within Panorama?

This action triggers Panorama to contact the Palo Alto Networks licensing servers and download the license files for the serial numbers it manages, assuming those licenses have been activated in the CSP.

5. How are retrieved license keys typically deployed from Panorama to the managed firewalls?

Once Panorama retrieves the license keys, deploying them to the firewalls is typically part of the regular configuration push workflow initiated via Commit and Push.

6. Which PAN-OS firewall platforms specifically require a "Web Proxy" license activation?

The documentation explicitly calls out the VM-Series, PA-1400 Series, and PA-3400 Series as platforms requiring the Web Proxy license to enable the feature.

7. True or False: Panorama can activate brand new, unactivated license authorization codes directly.

False. The initial activation of a purchased authorization code against a specific firewall serial number must be done in the Customer Support Portal (CSP). Panorama retrieves the *resulting* license key file *after* activation in the CSP.

8. Which Panorama feature is often used to manage capacity licenses for VM-Series firewalls?

Panorama can be configured to act as a central license manager for VM-Series firewalls using capacity-based licenses (like Software NGFW Credits), allocating licenses from a pool to VMs as needed.

9. What is required for Panorama to successfully retrieve license keys from the Palo Alto Networks license server?

Panorama needs to communicate externally with Palo Alto Networks' backend servers to download license keys. This requires appropriate network connectivity (DNS resolution, routing, firewall rules allowing HTTPS outbound).

10. The authoritative source for which licenses are assigned to which firewall serial numbers is:

The Customer Support Portal (CSP) is where licenses are registered and definitively associated with specific hardware or virtual firewall serial numbers. Panorama retrieves this information from the backend systems linked to the CSP.

References