How to Transfer PA-Series Licenses Along with Cloud/Tenant-Based License(s) (DLP, SaaS Inline, IoT Security, and AIOps for NGFW) to a Spare Device? (2024)

CSP
NGFW

• • Step 1
    Before performing the RMA License Transfer, please offboard the tenant(s) from the defective device following the instructions in the TechDocs.
    Please note that you can refer to the same document for SaaS Inline, DLP, AIOps licenses, as well as IoT Security.
    If not, you can refer to the instructions until Step 3 in the TechDocs.
    • If you successfully offboard the tenant(s) from the defective device, please proceed to Step 3 below.
    • If you encounter an error message, please open an Admin case through the support portal and please proceed to Step 2 below.
  • Step 2
    Our internal IT team will offboard the tenant(s) from the defective device on their end. Once this is completed, please refer to Step 3 below.
  • Step 3
    • If you came from Step 1 above, please open an Admin case to request the deactivation of the Cloud/Tenant-Based License(s) on the defective device.
    • If you came from Step 2 above, please request the deactivation of the Cloud/Tenant-Based License(s) on the defective device within the existing Admin case.
  • Step 4
    Once Step 3 above is completed in the Admin case, please proceed with the process,How to Transfer Licenses to a Spare Device and transfer the non-Cloud/Tenant-Based License(s) to a Spare device first.
  • Step 5
    

    DLP, SaaS Inline, IoT Security, and AIOps for NGFW without the Renewal SKU

    DLP, SaaS Inline, IoT Security, and AIOps for NGFWwith the Renewal SKU

    You can proceed with reactivating the Cloud/Tenant-Based License(s) on the spare device using the initial activation link.

    You can proceed with re-activating the Cloud/Tenant-Based License(s) on the spare device using the initial activation link. Once you reactivate the Cloud/Tenant-Based License(s) using the initial activation link, please inform us through the case you raised at either Step 2 or Step 3. We will perform a manual workaround to update the magic link to point to the renewal license and remove the Renewal SKU (-R) in the license, ensuring the activation works as it would with the initial license.

    Note: For activation, it is necessary that a user with the appropriate access rights to the existing TSGID performs the activation.
    If the user does not have access rights in the existing TSG, selecting the existing TSGID during activation will not be possible.
  • Step 6
    Once Step 5 is completed, as per the Techdocs, completing the association of a Spare Device in Common Services will reflect the license activated on a Spare device.

Notes:

• Cloud/Tenant-Based License(s) on a firewall is de-activated and the association is removed, the configuration will be removed. They will have to start from the scratch on the new device.
• If only one device is RMA'd, then it should only involve the configuration on the RMA'd device, as we will not delete the entire tenant but merely disassociate the RMA'd device from the tenant.

Q&A:

• Is there any service impact on existing(already activated) Cloud Service Module?
  Ans:
  Whichever the tenant is, if you need to remove the license from one firewall, then that will not affect the entire tenant.Only the required firewall tenant association will be removed.
  Note: Only when the entire tenant is requested to be deleted, then the tenant will be de-provisioned after removing all the devices under the tenant.
• Let's say the Could License is SaaS Inline and 4 devices within same tenant has SaaS Inline license attached. I've received Initial activation link for SaaS Inline Activation for 4 devices.
  If one of the device needs RMA, re-activating via initial activation link won't work because SaaS Inline Module is activated with 3 other devices associated.
  Ans:
  Initial activation link will work for licenses without the Renewal SKU.
• For step 5 to work, I think SaaS Inline module should be de deleted and all 4 devices should be disassociated beforehand. Is this so?
  Ans:
  Not required. Only one device can be dis-associated.