topic Re: NGFW Credits vs licensing for Panorama in Panorama Discussions

NGFW Credits vs licensing for Panorama

Schneur_Feldman — Tue, 22 Nov 2022 16:37:10 GMT

Team,

Am I reading this wrong or are there two ways to buy Panorama?

1. Buy NGFW Credits for Panorama

2. Buy a license for Panorama

Are these two valid options? If yes, what is the difference?

Re: NGFW Credits vs licensing for Panorama

MervynChan — Thu, 24 Nov 2022 07:12:28 GMT

From my understanding,

using NGFW credits to provision a Panorama is possible only if you created a deployment profile and enabled the panorama options in it.

And a valid deployment profile must at least have 1x firewall.

Therefore, it means that you cannot only buy NGFW credit for panorama. Since you need to provision a VM-firewall with in same profile.

see below docs for details

https://docs.paloaltonetworks.com/vm-series/11-0/vm-series-deployment/license-the-vm-series-firewall/software-ngfw/create-a-deployment-profile-vm-series

https://docs.paloaltonetworks.com/vm-series/11-0/vm-series-deployment/license-the-vm-series-firewall/software-ngfw/provision-panorama

Re: NGFW Credits vs licensing for Panorama

Schneur_Feldman — Tue, 29 Nov 2022 21:54:14 GMT

I think that confuses me more.

Re: NGFW Credits vs licensing for Panorama

TomYoung — Wed, 30 Nov 2022 03:18:54 GMT

Hi @Schneur_Feldman ,

The last time that I ran the calculator https://www.paloaltonetworks.com/resources/tools/ngfw-credits-estimator, purchasing credits for Panorama was cheaper than purchasing support. You configure the smallest NGFW VM allowed, and add Panorama to it. You don't have to deploy the NGFW.

Here's how it works:

Purchase credits.
Create a deployment profile in the CSP mapping resources and licenses to credits.
The VM- or CN-Series gets its resource and license allocation from the deployment profile.

There are 2 main options for VM Panorama:

Purchase permanent device license and subscription support. You own Panorama, but require support.
Purchase NGFW credits and "lease" Panorama every year. NGFW credits include support for free.

The credits are a good deal for VM-Series. I think they are a lot cheaper than the cloud marketplaces.

https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/license-the-vm-series-firewall/software-ngfw

Thanks,

Tom

Re: NGFW Credits vs licensing for Panorama

rezavage — Thu, 26 Jan 2023 18:27:38 GMT

Hi, can some one help me understand this.

So lets say we are deploying 2 VM with Panorama management selected.

Do we still need to buy additional license/credit for Panorama deployment on Azure? (it says that Panorama licensing is BYOL!?)
Later, If we decide to add few on-prem PA to this Azure Panorama, how the licensing should be done. is it like adding a PAN-PRA-25 .
I already have a PAN-PRA-25 for my on-prem Panorama, can I use it for adding same PA under the new Azure Panorama, or does it need separate license pack.

Thanks,

Re: NGFW Credits vs licensing for Panorama

TomYoung — Thu, 26 Jan 2023 19:18:54 GMT

Hi @MervynChan ,

That is correct, but adding Panorama is only a couple credits! Check out the credit estimator above. You could buy a vNGFW and not use it. I was told by distribution this works, and is an affordable way to purchase Panorama.

I would LOVE it if someone would respond and say they have done this. I did not use credits to purchase Panorama.

https://docs.paloaltonetworks.com/vm-series/10-1/vm-series-deployment/license-the-vm-series-firewall/software-ngfw/provision-panorama

Thanks,

Tom

Re: NGFW Credits vs licensing for Panorama

TomYoung — Thu, 26 Jan 2023 19:18:06 GMT

Hi @rezavage ,

That is a great question. I would assume that you would need to build 2 Deployment Profiles to build 2 Panorama VMs.

This is what I was told by distribution:

Each provisioned Panorama VM includes a 25-device license and support. Where in your screen shot does it say Panorama licenses are BYOL? BTW, all NGFW credits are BYOL since they are not purchased through the cloud marketplace. They get their licenses through the CSP and Deployment Profiles.
Great question. The VM supports 25 devices. So, you shouldn't have to add anything. I don't think 100 is supported.
If you use NGFW credits, it comes with a 25-device license. If you build any cloud Panorama (paying for resources separately) you should be able to transfer the license. You could also convert the PRA-25 to NGFW credits. See links below.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClNM

https://docs.paloaltonetworks.com/vm-series/10-1/vm-series-deployment/license-the-vm-series-firewall/software-ngfw/migrate-panorama-to-a-flexible-license

Final thought: I have not used NGFW credits to provision Panorama. This is what I have been told. I would LOVE drive-bys who have done this to post their experience.

Thanks,

Tom

Re: NGFW Credits vs licensing for Panorama

m_kopcic — Mon, 21 Oct 2024 11:20:43 GMT

Hello!

Does somebody knows if Panorama bought with credits can be used to manage hw firewalls? I worked with Panorama VM with perpetual licenses and I don't see how Panorama can limit hw firewalls, but I want to be sure.

Regards,

Maja