NGFW Credits vs licensing for Panorama

[Schneur_Feldman]

Team,

Am I reading this wrong or are there two ways to buy Panorama?

1. Buy NGFW Credits for Panorama

2. Buy a license for Panorama

Are these two valid options? If yes, what is the difference?

[MervynChan]

From my understanding,

using NGFW credits to provision a Panorama is possible only if you created a deployment profile and enabled the panorama options in it.

And a valid deployment profile must at least have 1x firewall.

Therefore, it means that you cannot only buy NGFW credit for panorama. Since you need to provision a VM-firewall with in same profile.

see below docs for details

https://docs.paloaltonetworks.com/vm-series/11-0/vm-series-deployment/license-the-vm-series-firewall... 

https://docs.paloaltonetworks.com/vm-series/11-0/vm-series-deployment/license-the-vm-series-firewall...

[Schneur_Feldman]

I think that confuses me more.

[TomYoung · Accepted solution]

Hi @Schneur_Feldman ,

The last time that I ran the calculator https://www.paloaltonetworks.com/resources/tools/ngfw-credits-estimator, purchasing credits for Panorama was cheaper than purchasing support.  You configure the smallest NGFW VM allowed, and add Panorama to it.  You don't have to deploy the NGFW.

Here's how it works:

1. Purchase credits.
2. Create a deployment profile in the CSP mapping resources and licenses to credits.
3. The VM- or CN-Series gets its resource and license allocation from the deployment profile.

There are 2 main options for VM Panorama:

1. Purchase permanent device license and subscription support.  You own Panorama, but require support.
2. Purchase NGFW credits and "lease" Panorama every year.  NGFW credits include support for free.

The credits are a good deal for VM-Series.  I think they are a lot cheaper than the cloud marketplaces.

https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/license-the-vm-series-firewall/...

Thanks,

Tom

[rezavage]

Hi, can some one help me understand this.

So lets say we are deploying 2 VM with Panorama management selected. 

1. Do we still need to buy additional license/credit for Panorama deployment on Azure? (it says that Panorama licensing is BYOL!?)
2. Later, If we decide to add few on-prem PA to this Azure Panorama, how the licensing should be done. is it like adding a PAN-PRA-25 .
3. I already have a PAN-PRA-25 for my on-prem Panorama, can I use it for adding same PA under the new Azure Panorama, or does it need separate license pack.

Thanks,

[TomYoung]

Hi @MervynChan ,

That is correct, but adding Panorama is only a couple credits!  Check out the credit estimator above.  You could buy a vNGFW and not use it.  I was told by distribution this works, and is an affordable way to purchase Panorama.

I would LOVE it if someone would respond and say they have done this.  I did not use credits to purchase Panorama.

https://docs.paloaltonetworks.com/vm-series/10-1/vm-series-deployment/license-the-vm-series-firewall...

Thanks,

Tom

[TomYoung]

Hi @rezavage ,

That is a great question.  I would assume that you would need to build 2 Deployment Profiles to build 2 Panorama VMs.

This is what I was told by distribution:

1. Each provisioned Panorama VM includes a 25-device license and support.  Where in your screen shot does it say Panorama licenses are BYOL?  BTW, all NGFW credits are BYOL since they are not purchased through the cloud marketplace.  They get their licenses through the CSP and Deployment Profiles.
2. Great question.  The VM supports 25 devices.  So, you shouldn't have to add anything.  I don't think 100 is supported.
3. If you use NGFW credits, it comes with a 25-device license.  If you build any cloud Panorama (paying for resources separately) you should be able to transfer the license.  You could also convert the PRA-25 to NGFW credits.  See links below.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClNM

https://docs.paloaltonetworks.com/vm-series/10-1/vm-series-deployment/license-the-vm-series-firewall...

Final thought:  I have not used NGFW credits to provision Panorama.  This is what I have been told.  I would LOVE drive-bys who have done this to post their experience.

Thanks,

Tom