topic Re: FlexVM Licensing with Software NGFW Credits in Next-Generation Firewall Discussions

FlexVM Licensing with Software NGFW Credits

Remo — Fri, 25 Jun 2021 07:24:33 GMT

Hi all,

As you probably know, paloalto recently changed the licensing of VM firewalls. With greater flexibility (and higher licensing costs), there is now also the possibility to increase only the RAM for such a VM firewall which results in higher capacity for rules, zones, concurrent sessions. Some of the specs which change with a different memory profile are written here: https://docs.paloaltonetworks.com/vm-series/10-0/vm-series-deployment/license-the-vm-series-firewall/software-ngfw.html

My question@ now are: are these the only specs that change with a different memory profile? What about concurrent dercypted sessions, virtual routers, ...? Does the vm refuse to boot if there is for example 20 GB of RAM attached or does the vm simply use the highes possible amount of RAM according to the memory profile?

Re: FlexVM Licensing with Software NGFW Credits

emr_1 — Fri, 25 Jun 2021 08:28:35 GMT

Comparison Tool has spec for VMs

Here is example to compare 6 types of VMs

https://www.paloaltonetworks.com/products/product-comparison?chosen=vm-series (2 vcpu, 6.5 gb),vm-series (4 vcpu, 9 gb),vm-series (8 vcpu, 16 gb),vm-series (16 vcpu, 56 gb),vm-series (22 vcpu, 56 gb),vm-series (32vcpu, 56 gb)

I can see there is difference in SSL Decryption section, Security Profiles, so on..

Regard,

Emr

Re: FlexVM Licensing with Software NGFW Credits

Remo — Fri, 25 Jun 2021 09:15:00 GMT

Hi @emr_1

Thanks for your reply.

I saw that there are new options in the comparison tool, but so far these options actually are only the "old" vm-types (vm-100, vm-300, ...) with new names. My question is if only the RAM is increased. As shown in the link there are some specs which change if RAM is increased but what is about all the other specs which I mentionned (virtual router, concurrent decrypted sessions, ...)

Re: FlexVM Licensing with Software NGFW Credits

Remo — Fri, 25 Jun 2021 18:47:18 GMT

@istrydom / @sduvoisin / @vogeln

Are you able to answer this prior to anyone in the community? 😉

An answer will probably also help others and not only me ...

Re: FlexVM Licensing with Software NGFW Credits

istrydom — Tue, 29 Jun 2021 06:58:18 GMT

@Remo It loads the memory profile based on the memory assigned. Ex: if you assign 20G RAM, it will load 16G memory profile (one out of 6 profiles that we support)

Re: FlexVM Licensing with Software NGFW Credits

istrydom — Wed, 30 Jun 2021 13:19:39 GMT

@Remo Also note that nothing will change regarding virtual routers, or concurrent decryption sessions, even if more RAM is added - the VM-series license is a capacity license. Whatever it is licensed for will be the maximums for sessions and virtual routers. You will have to apply a larger license or Flex Profile to increase session capacities.

Re: FlexVM Licensing with Software NGFW Credits

Remo — Wed, 30 Jun 2021 19:43:54 GMT

Hi @istrydom

This applies to the old VM licensing. With the new software NGFW credits it is possible to increase the max. zones, max concurrent session, and some more specs simply by adding more RAM. All this is documented in the link in my first post (this one: https://docs.paloaltonetworks.com/vm-series/10-0/vm-series-deployment/license-the-vm-series-firewall/software-ngfw.html )

There the following sentence is written: "The following table shows the firewall capacity for each memory profile. Unlike VM-series models, Software NGFW Credits from PAN-OS 10.0.4 onwards allow you to choose the memory profile that best fits your environment without consuming any additional credits."

So my question still is how do other specs change when you add more RAM?

Re: FlexVM Licensing with Software NGFW Credits

istrydom — Thu, 01 Jul 2021 06:35:53 GMT

@Remo Hi Remo, Increasing the memory and in essence the memory profile will give you some gains around certain functions handled by the control plane as per the table at the bottom of this page you shared:
https://docs.paloaltonetworks.com/vm-series/10-0/vm-series-deployment/license-the-vm-series-firewall/software-ngfw.html
The items you are asking about though are dataplane related and as such won’t see an increase. This was confirmed by the vm-series teams.

Re: FlexVM Licensing with Software NGFW Credits

Remo — Sat, 24 Jul 2021 15:18:14 GMT

Hi @istrydom

Thanks for clarifying this with the Paloalto VM team. At least my question is now answered --> when the memory profile is increased also the maximum supported decrypted sessions will increase:

4.5 GB = 1'024 decrypted sessions

5.5 GB = 1'024 decrypted sessions

6.5 GB = 6'400 decrypted sessions

9 GB = 15'000 decrypted sessions

16 GB = 50'000 decrypted sessions

56 GB = 100'000 decrypted sessions

These sessions increase only by adding more RAM and it does not matter how many vCPUs you have licensed and added.

The virtual routers are tied to the vCPU count, so here you don't get more vrouters with more RAM.

Re: FlexVM Licensing with Software NGFW Credits

Ramakrishnan — Fri, 03 Dec 2021 04:18:03 GMT

As per my understanding VM flex license we shall chose CPU, RAM and interfaces based on credits. Is there any useful link?