License Question: IoT Security VS IoT Security, Does Not Require Datalake

[inssider]

What is the effective difference between these two licenses? I cannot find much information on it.

I have a customer who purchased an IoT Security licenses for their PA-440's. They purchased the normal PAN-PA-440-IOT license but did not appear to purchase a Cortex Data Lake license with it. I notice that there is another type of IoT Security license, PAN-PA-440-IOT-DRDL, which means IoT Security, Does not Require Datalake. I'm trying to figure out if I'll need my customer to purchase a Data Lake license, or if I'll need them to switch to the DRDL version of the license, but I'm unsure of which option is correct since I've never configured IoT Security before. What are the implications of not using the Data Lake?

[TomYoung]

HI @inssider ,

Yes, the customer will need to purchase CDL.  https://docs.paloaltonetworks.com/iot/iot-security-admin/get-started-with-iot-security/iot-security-...

I don't know if you can switch licenses once purchased.  The DRDL license is more expensive.  If you have a lot of NGFWs and a lot of IoT licenses, it is cheaper to purchase CDL separately.  I have also heard of more provisioning issues with the DRDL version through word of mouth and this thread.  https://live.paloaltonetworks.com/t5/iot-security-discussions/iot-security-does-not-require-data-lak...

Thanks,

Tom

[inssider]

It appears that we have a Cortex Data Lake license in our assets inventory even though we never specifically ordered it:

Also, in the Support Portal under cloud services, I see this, but it says 0TB:

So is it possible that we got a "free" CDL license when buying IoT but it has no storage? 

[TomYoung]

Hi @inssider ,

You get a free CDL when you enable telemetry and/or AIOps.  You cannot use that for IoT as the 0 TB indicates.  Unless you order DRDL, you don't get CDL with an IoT subscription.

Thanks,

Tom

[inssider]

Makes sense. But is it possible to use IoT Security with no CDL while using the normal IOT license? We didn't order the DRDL one but we also didn't order a CDL. This is my dilemma. 

[dannon]

Hi, we had this same situation.  Reseller didn't order the full IOT+CDL sub and just did IOT.  Pain in the rear to fix after the fact for us.  Answer is no, you have to have the CDL add-on to use IoT.  I was told someone forgot to use the correct SKU when it was renewed.  We ended up getting it fixed after 3 months, but ended up having to buy the CDL after the fact.

Hope that helps

dannon