add vsys license from HA pair managed by Panorama. Any step? Reboot required ?

[Martin_Chung]

I have a HA pair firewall without vsys license.

Now, i would like to add the vsys license in this HA pair in production environment,

Do the traffic affected ?

how is HA status ?

if so, how to minimize the impact for adding the vsys license ?

from some document, the device will be in suspended status. 

some people said that the device have to reboot for enabling the vsys license.

Please HELP !

[JayGolf]

Hi @Martin_Chung ,

Which firewall platform are you using, and how many VSYS do you plan on creating?

Adding/retrieving the VSYS license itself should not normally impact traffic. The part that needs to be planned carefully is enabling Multi-Vsys on the HA pair.

To minimize impact, I would recommend performing this during a maintenance window and doing the following:

1. Confirm both HA peers are healthy and synchronized.
2. Export config/device state backups.
3. Retrieve/install the VSYS license on both firewalls.
4. Temporarily disable HA config sync. This helps prevent partial or mismatched configuration sync while each peer is being updated individually.
5. Enable Multi Virtual System Capability on one peer, then the other.
6. If a peer enters suspended state, make it functional again after both peers match.
7. Re-enable HA config sync.
8. Verify HA status, config sync, sessions/traffic, and commit status.

A reboot is not always the main concern here. The bigger concern is the temporary HA mismatch while Multi-VSYS is enabled on one peer and not yet enabled on the other. If the GUI/CLI prompts for a reboot on your specific platform/PAN-OS version, follow that prompt and perform it during the maintenance window.

Also, if the firewalls are Panorama-managed, review the Panorama/device group/template configuration after enabling Multi-VSYS. Once Multi-VSYS is enabled, some configuration may need to be assigned or organized by VSYS, so it is best to validate the Panorama push behavior before making additional VSYS changes.