Palo Alto Networks Software NGFW credits are the current licensing model for the company’s software firewalls. They are term-based credits that fund VM-Series and CN-Series firewalls, Cloud-Delivered Security Services (CDSS) and virtual Panorama appliances, in networks with or without internet access.[2] The VM-Series supports two licence types, bring-your-own-licence (BYOL) and PayGo, and two licensing models: Software NGFW credits for flexible configurations defined in a deployment profile, and fixed VM-Series model configurations.[1] New fixed capacity licences are no longer sold, so credits are the default for new deployments, while existing model licences remain renewable.[1] In older documents and Enterprise Program terms, the credits appear as “FW Flex” or “firewall flex credits”.[9]
Editions
The documentation compares the two models as follows:[1]
| Flexible vCPUs (Software NGFW credits) | VM-Series Model (fixed vCPUs) | |
|---|---|---|
| Cost basis | Number of vCPUs and chosen security services; Panorama costs only the vCPUs it consumes | Model capacity licence, device memory and storage; Panorama and services bought separately |
| Security services | Any combination, added or removed at any time | Bundle 1 (Threat Prevention and Premium Support) or Bundle 2 (adds DNS Security, GlobalProtect, WildFire, URL Filtering, SD-WAN, DLP) on perpetual licences |
| PAN-OS | Up to 64 flexible vCPUs on 10.0.4 and later | Any PAN-OS version |
| Funding | Reusable credits in a credit pool | Multi-Model ELA tokens, perpetual licence or term licence |
| Change | Deployment profile can change at any time | Model change needs a new licence and a reboot |
The fixed-model family includes the VM-50, VM-100, VM-300, VM-500, VM-700 and VM-1000-HV, which the Grace Periods policy lists among the perpetual bundles.[7] The VM-Series documentation states that “New capacity licenses (non-Software NGFW Credits) are no longer available for purchase”, but one-year renewals of perpetual and term capacity licences are still offered (rule).[1]
Metrics
- Software NGFW Credit: the funding unit of the credit pool.
- vCPU (Software NGFW flexible vCPU): the capacity dimension that, with the security services, drives credit consumption per firewall.
- VM-Series Model capacity license: one fixed-size licence per firewall.
- VM-Series ELA token: the unit of the Multi-Model ELA token pool, which is separate from the Software NGFW credit pool.[1]
The number of credits a given combination of vCPUs and services consumes is calculated by the vendor’s Software NGFW Credit Estimator.[2] The documents cited here do not publish a fixed rate table, so the catalog records the metric without per-vCPU rates.
Counting / floors
Credit pools and deployment profiles
Purchased credits are activated from an email link into a default credit pool. During activation only one support account can be chosen per default credit pool. Once the pool is active, users with the Credit Administrator role allocate credits to deployments and can transfer credits between pools (rule).[5] Credits are consumed by deployment profiles. A profile sets the PAN-OS version, the vCPUs per firewall, the total number of firewalls it supports, optional Panorama management or log collection, and the security services. All VMs created with a profile share one auth code.[2]
Fixed-vCPU profiles follow the VM-Series models and service bundles, and changing the model or services needs a new licence. Flexible-vCPU profiles can add or remove vCPUs and services at any time, up to a maximum of 64 vCPUs for a deployment profile (rule).[2] The minimum is 2 vCPUs for every memory profile.[2]
Term and expiry
Software NGFW credits are term-based, with any term from 1 to 5 years, and both allocated and unallocated credits expire at the end of the term. Credits added to an existing pool must have the same expiration date as that pool (rule).[2] There is no grace period: credit pools start on the email delivery date of the activation link.[7]
When a deployment profile expires it moves to a Renew Profiles tab, and the customer has 30 days to renew it before it moves to Expired Deployment Profiles. A renewal with at least as many credits restores the profiles automatically. A renewal with fewer credits requires the customer either to reduce consumption first or to choose which profiles to renew. The vendor also warns that the credit count may change at renewal because of changes in the pricing model (rule).[4]
Reuse
Credits are reusable. If the firewall can reach the licence server, stopping a firewall, security service or Panorama deployment refunds its credits to the pool for reallocation. In air-gapped networks the administrator returns the licence token in the Customer Support Portal so the funds can be reused (rule).[2]
Virtualization & partitioning
The licensed unit is the vCPU count of the firewall VM, not the physical host. The customer can license fewer vCPUs than the compute instance provides by using the set-cores bootstrap or CLI command (VM-Series plugin 2.1.4 or later, followed by a reboot). This lets a larger instance run without consuming more Software NGFW credits than necessary (rule).[3] By default, management plane and dataplane vCPUs are split one to three when more than four vCPUs are assigned, and the maximum number of dataplane vCPUs depends on the allocated memory tier.[2] Supported environments include ESXi, Hyper-V, KVM, NSX-T, AWS, Azure, Google Cloud, OCI and Alibaba Cloud.[2]
The EULA prohibits using Software licensed for a specific device, physical or virtual, on another device without written authorization.[8] This matters for fixed VM-Series model licences, which are registered to an individual firewall. Credit-funded firewalls instead share their deployment profile’s auth code.[1]
Cloud / BYOL
BYOL covers both Software NGFW credits and VM-Series model licences. PayGo is bought from a public cloud marketplace (AWS, Azure or GCP) or through a Cloud Security Service Provider. On PAN-OS 9.1.1 and later, PayGo supports the fixed models VM-100, VM-300, VM-500 and VM-700; earlier releases supported only the VM-300.[1] The EULA governs the product whether it was acquired directly, through a reseller or through a cloud marketplace, and its overuse clause allows true-up charges to be collected through a marketplace.[8]
Programs
- Software NGFW Credits: the credit pool program described above.
- VM-Series Enterprise License Agreement (Multi-Model ELA): a one- or three-year agreement in which individual licences, each able to combine a model, security services, support and an optional Panorama device management licence, are funded from a token pool.[1]
- VM-Series PayGo: marketplace consumption, as above.
- Cloud Security Service Provider (CSSP) program: usage-based packages for enrolled service providers. These combine a term capacity licence for a VM-Series model with subscriptions and support, on hourly, monthly, 1-year or 3-year terms, with an optional high-availability option.[6] Outside such an authorization, the EULA prohibits acting as a managed services provider with the products.[8]
- Enterprise Program conversions: for Enterprise Program (Attached Subscriptions) terms of three years or more, 80% of unused Attached Subscription value can be credited toward FW Flex credits, Cloud NGFW or Prisma Access. The Enterprise Program itself excludes FW-Flex (formerly VM-Series) licences.[9]
Credit-funded firewalls can add Strata Cloud Manager Pro. When Strata Logging Service with sized storage and AIOps for NGFW Premium were retired, VM-Series deployments funded by Software NGFW credits were migrated to Strata Logging Service with one year retention and to Strata Cloud Manager Pro.[10]
Out of scope
This article does not cover Cloud NGFW for AWS and Azure (a managed service with its own terms), hardware PA-Series firewalls, per-vCPU credit rates (not published in the cited documents), CN-Series deployment specifics, or list prices.