Palo Alto Networks hardware firewall subscriptions are licensed per device: each PA-Series firewall is registered to the customer’s support account, and cloud-delivered security services and support contracts are activated on it with authorization codes.[6] As an alternative to device-by-device purchasing, the Enterprise Program offers estate-wide volume arrangements. The Enterprise Program for Attached Subscriptions (ELA) covers firewall subscriptions, and the Enterprise Program for Hardware Support (ESA) covers support and maintenance. Both use a forecast-based Total Hardware Cap.[1][2] Three support policies set start dates, second-hand use and end of life. The ELA supplements the End User License Agreement and takes precedence over it only for the ELA purchase.[1]
Editions
Per-device subscriptions
The subscriptions that can be attached to a firewall include Threat Prevention and Advanced Threat Prevention, DNS Security and Advanced DNS Security, Advanced URL Filtering, WildFire and Advanced WildFire, GlobalProtect Gateway, SD-WAN, IoT Security, AutoFocus, Strata Logging Service, Strata Cloud Manager and the perpetual Virtual Systems licence.[7] Several have dependencies. DNS Security requires a Threat Prevention licence. URL Filtering is no longer sold standalone, and its features sit in Advanced URL Filtering. GlobalProtect portals and gateways without HIP checks need no licence, but advanced features need a GlobalProtect Gateway licence for each gateway (rule).[7]
Enterprise Program editions
The standard Enterprise Program (for Attached Subscriptions) entitles the customer during the term to six Attached Subscriptions: Advanced Threat Prevention, Advanced WildFire, Advanced URL Filtering, Advanced DNS Security (with the ADNS Resolver Service), PAA (Prisma Access Agent and GlobalProtect Gateway) and Advanced SD-WAN for PAN-OS. The updated ELA8 adds Advanced IP Defense, which the document gives a general availability date of 2026-08-20.[1] Add-on Subscriptions can be bought under the same pricing structure: IoT/Device Security, Enterprise DLP, SCM Pro (for customers not receiving it under an ESA), AIOps, Quantum and SaaS Security.[1]
The ESA covers support and maintenance for the customer’s entire hardware firewall estate, including M-Series and WF-XXX appliances, at a single level. The customer picks Platinum, Premium or USG and cannot combine them; USG is available only at Premium level (rule).[2] Except for Public Sector and certain other customers, an ESA includes Strata Cloud Manager Pro.[2]
Metrics
Outside the Enterprise Program, the unit is the attached subscription per firewall. The EULA prohibits using Software licensed for a specific device on another device without written authorization (rule).[6] Inside the Enterprise Program, device counts are replaced by a value cap. The Current Hardware Estate and the customer’s Forecasted Hardware Estate are “calculated based on the current hardware list price”.[1]
Counting / floors
Total Hardware Cap
| Term | Limit |
|---|---|
| 1-year term | Attached Subscriptions (ELA) or support (ESA) on an unlimited number of hardware firewalls, if the new devices are bought during the term and registered to the customer’s support account |
| Term greater than 1 year | Current Hardware Estate plus devices up to the Total Hardware Cap, with the same purchase and registration conditions |
The Total Hardware Cap is defined as the Current Hardware Estate plus twenty percent above a net positive Forecasted Hardware Estate (rule).[1][2] A 5-year term is available only to select accounts approved case by case.[1]
Over-consumption
The customer monitors the hardware associated with Attached Subscriptions in the Customer Support Portal consumption dashboard. Fees for over-consumption beyond the Total Hardware Cap are reconciled with actual usage at the end of each month (rule).[1] Once the cap is exceeded, the customer cannot deploy or increase Attached Subscriptions until it takes one of three options:
- True-Forward Add-on SKU: a non-cancellable, non-refundable order that raises the Forecasted Hardware Estate.
- Decommission: removing specific devices from the estate within 60 days of the over-consumption, validated by Palo Alto Networks.
- Early Renew: for terms of at least three years, recalculating the forecast for a new term, with 60 business days to start the process.
If none is taken, Palo Alto Networks may terminate or suspend the subscriptions under the EULA.[1] End-of-Life devices kept beyond their EOL date count towards the Total Hardware Cap (rule).[1]
Exclusions
The ELA does not apply to divested assets (which earn no credits or refunds), M-Series, WF-xxx or SD-WAN ION appliances, hardware managed or supported by a third party, software licences such as AutoFocus, Cortex, Panorama, Prisma Access, Prisma Cloud and FW-Flex (formerly VM-Series), or FedRAMP-authorized subscriptions. Once a purchase order is accepted it cannot be cancelled or refunded, and the ELA cannot be terminated for convenience (rule).[1]
Start dates
Under the Grace Period Policy, a support contract starts when the product is registered or 30 days (North America) or 90 days (outside North America) after hardware shipment, whichever is earlier. The clock runs from the ship date, not the delivery of the support authorization code (rule).[3] Attached subscriptions start at activation or 90 days after delivery of the authorization code, whichever is earlier, and expire at the end of their term even if never activated (rule). Prisma SD-WAN subscriptions have a 30-day grace period instead.[3] Support renewals start at the end of the previous contract regardless of any gap (rule). Enterprise Agreements have no grace period and start on the later of the authorization code delivery date and the customer’s requested start date.[3] For stocking orders, the grace period starts on the distributor’s point-of-sale report, and no subscriptions can be attached until that report arrives.[3]
Expiry
A daily warning appears in the system log for the 30 days before expiry. The licence expires at 12:00 AM GMT at the start of the day after the end date. After expiry, installed Threat Prevention signatures and custom URL categories remain usable, but new signatures, PAN-DB lookups and real-time machine-learning detection stop. When support expires, software updates and technical support end.[8]
Virtualization & partitioning
Hardware firewalls are not licensed by processor. Multiple virtual systems on one firewall need a Virtual Systems licence above the platform’s base number (perpetual on the PA-3200 Series).[7] Software firewalls are covered in the Software NGFW credits article.
Cloud / BYOL
For ELA terms of three years or more, excluding Public Sector customers, a customer that does not expect to use its full Total Hardware Cap can ask every 12 months to convert value. It receives 80% of the remaining Attached Subscription value (after deducting what is needed for the current and forecasted estate) as Pro-rated Credits, usable only toward Prisma Access mobile users and remote networks SKUs, Cloud NGFW or FW Flex credits (rule).[1] The credits become available no earlier than 12 months into the term, must be used in full in a single transaction, have no cash value, and reduce Attached Subscription usage for the rest of the term.[1]
Programs
Secondary market
Licences and subscriptions that come with a previously owned device do not transfer to the buyer; Palo Alto Networks treats them as expired. Lost or stolen devices, and devices that are end-of-sale or decommissioned, cannot be re-certified. The buyer places two orders through an authorized reseller: a non-refundable certification fee, then a one-time activation fee with at least one year of support. The device then goes through verification (rule).[4] The EULA applies this policy to products bought from unauthorized resellers.[6] The support agreement reserves the right not to support such products.[9]
End of life
Palo Alto Networks aims to give 6 months’ notice before a hardware product’s End-of-Sale. It provides technical assistance and replacement parts for 5 years after End-of-Sale, provided support is maintained continuously. A product must be under support on its End-of-Sale date to be eligible for renewal, and support cannot lapse and later be reinstated (rule).[5] Buying an ELA does not change these End-of-Life obligations.[1]
Lab units
Lab SKUs exist for hardware and virtual firewalls, management devices and attached subscriptions, usually at discounted rates. They are for non-production use only and are not eligible for Premium Support or advanced RMA.[10] The EULA prohibits production use of Lab or NFR SKUs.[6]
Out of scope
This article does not cover hardware specifications or pricing, the SD-WAN variants of the Enterprise Program published separately on the vendor’s legal page, Prisma Access (see Prisma Access licensing), or public-sector and FedRAMP variants.