Failing to apply VM license

[aleksandar.astardzhiev]

Hi Guys,

I am trying to apply CSSP license on one virtual firewall. When I try to attach the received license I receiving the following error:

"Failed to install licenses, Model incompatible: feature model is VM100 while the device model is PRA”

I got the same for two different firewalls, I am starting to suspect that the template has some issues. The ova template is for 8.0.5

[OtakarKlier]

Hello,

I would say reach out to your sales team and SE and see if you can get the proper license. OR try to download it from the device directly.

Regards,

[BPry]

@aleksandar.astardzhiev,

Are you sure that you are actually deploying the VM-100 OVA and not the Panorama VM OVA? 

[aleksandar.astardzhiev]

Hi @BPry,

I am more than sure that template is for FW and not for Panorama. Even if that was the case the different GUI will definately ring a bell immidiately after login 🙂

Our contact from Palo Alto explained to me the following way:

"I have seen it a number of times that when you add the wrong key first, i.e the threat key, before the VM and support key you get this error.

But normally if you add all the licences, and then reboot the VM the error goes. It is to do with the fact the VM before you add the licence has no personality (it does not know what it is)"

So the main reason for such error is that the pa-vm.key is not propely installed, so the VM doesn't know what capacity it is (or even if it a firewall).

After further discussion we figured out that there are lots of unfortunate events:

- The VM was assiged with 4G of RAM, which is below the minimum requirements for VM-100

- The customer (that is actually trying to license his self-managed device) as not attaching the pa-vm.key on the first step, but actually using the "Retrieve license from server" as first step  - before attaching pa-vm.key

- The license was generated using UUID which has a typo - I had to type the UUID and CPUID in the portal manually as they were provided to me as an image. It turns out that the CSSP portal is not able to validated the UUID nor CPUID, so when you try to attach the pa-vm.key license it will fail as it doesn't matching the VM

So lessons learned:

- Never type UUID and CPUID by hand
- Always attach pa-vm.key first

- Never trust end customer that he has perform the correct licensing steps.