License Question: IoT Security VS IoT Security, Does Not Require Datalake

[inssider]

What is the effective difference between these two licenses? I cannot find much information on it.

I have a customer who purchased an IoT Security licenses for their PA-440's. They purchased the normal PAN-PA-440-IOT license but did not appear to purchase a Cortex Data Lake license with it. I notice that there is another type of IoT Security license, PAN-PA-440-IOT-DRDL, which means IoT Security, Does not Require Datalake. I'm trying to figure out if I'll need my customer to purchase a Data Lake license, or if I'll need them to switch to the DRDL version of the license, but I'm unsure of which option is correct since I've never configured IoT Security before. What are the implications of not using the Data Lake?

[TomYoung]

HI @inssider ,

Yes, the customer will need to purchase CDL.  https://docs.paloaltonetworks.com/iot/iot-security-admin/get-started-with-iot-security/iot-security-...

I don't know if you can switch licenses once purchased.  The DRDL license is more expensive.  If you have a lot of NGFWs and a lot of IoT licenses, it is cheaper to purchase CDL separately.  I have also heard of more provisioning issues with the DRDL version through word of mouth and this thread.  https://live.paloaltonetworks.com/t5/iot-security-discussions/iot-security-does-not-require-data-lak...

Thanks,

Tom

[inssider]

It appears that we have a Cortex Data Lake license in our assets inventory even though we never specifically ordered it:

Also, in the Support Portal under cloud services, I see this, but it says 0TB:

So is it possible that we got a "free" CDL license when buying IoT but it has no storage? 

[TomYoung]

Hi @inssider ,

You get a free CDL when you enable telemetry and/or AIOps.  You cannot use that for IoT as the 0 TB indicates.  Unless you order DRDL, you don't get CDL with an IoT subscription.

Thanks,

Tom

[inssider]

Makes sense. But is it possible to use IoT Security with no CDL while using the normal IOT license? We didn't order the DRDL one but we also didn't order a CDL. This is my dilemma.