The Ultimate Guide to Palo Alto Networks Software NGFW (Flex) Credits. How NGFW credits work, Renewal considerations, Online Credit Estimator, Deployment Profiles

Discover the ins and outs of using Palo Alto Networks’ Software NGFW (Flex) credits to seamlessly renew your cloud-based or virtualized software NGFW devices! Dive into this exciting guide where we unravel the mysteries of software NGFW credits, show you how they're allocated to your deployment profile, and walk you through the renewal and verification process.

Learn to calculate your required NGFW credits with the online Credit Estimator and much more. Get ready to master your NGFW credits and keep your network security top-notch!

Key Topics:

• Grasping the Basics of Software NGFW (Flex) Credits
• Estimating Your NGFW Credit Needs with the Credit Estimator
• Renewing Your Deployment Profile with NGFW Credits
• Summary

Grasping the Basics of Software NGFW (Flex) Credits

Palo Alto Networks’ Cloud-based (Azure, AWS, GCP) and virtualized (ESXi, Hyper-V, KVM) deployments, aka software NGFW devices, are licensed using Software NGFW credits (Flex Credits). When deploying a software NGFW device, you are required to purchase the correct amount of NGFW credits to allow the deployment, licensing and operation of the device. The amount of NGFW credits required, depend on the specifications of your NGFW device which include:

• Number and type (VM-Series or CN-Series) of firewalls deployed.
• Number of vCPUs per firewall.
• Subscriptions e.g Threat Prevention, URL Filtering, Wildfire etc.
• Management Options e.g Panorama Management, Panorama Log Collector etc.
• Support Options e.g Premium or Platinum support.

NGFW credits are subscription-based, meaning they expire 12 or 36 months after purchase (depending on your contract), regardless of how many credits you use.  For example, if you purchase 100 NGFW credits 12-month subscription and use 80 NGFW credits for your deployment, the remaining 20 NGFW credits will be available for consumption, but expire at the end of the contract.

It's crucial to purchase the right amount of NGFW credits to minimize any that go unused.

Estimating Your NGFW Credit Needs with the Credit Estimator

Estimating the number of NGFW credits for your deployment can be tricky. Thankfully Palo Alto Networks’ have created a tool that accurately calculates the number of credits required for different configuration and licensing subscriptions. The Software NGFW Credit Estimator is a handy online web-based tool that supports all software-based deployment options and displays the amount of NGFW credits required to correctly license your environment:

Palo Alto Networks - Software NGFW Flex Credit Estimator (click to enlarge)

Renewing Your Deployment Profile with NGFW Credits

To find out the amount of NGFW credits required for an existing deployment, simply log into the Palo Alto Networks support portal and select Products > Software NGFW Credits. The portal will display the total credits purchased, credits allocated to deployment profiles and remaining available credits:

In the example above, we're using 54.74 out of 55 credits, leaving just 0.26 credits unused. This is an ideal situation, demonstrating that we need exactly 55 credits. When purchased, these new credits will be added to the existing Credit Pool ID shown above.

However, if you plan to add additional features or licenses to your deployment profiles, it's highly recommended to account for the extra credits needed when placing your order.

Renewing an Existing Deployment Profile using NGFW Credits

Once we’ve ordered our credits they’ll be allocated to our Credit Pool ID, enabling us to renew the deployment profile.

Renewing a deployment profile is a straight-forward process. Log into your Palo Alto support portal and select Products > Software NGFW Credits. The purchased NGFW credits should appear in your Credit Pool, as illustrated below.

In our example, we bought a total of 65 NGFW credits. These credits were added to our Credit Pool and are now available for allocation to the deployment profile, as shown below.

When ready, click on the Details button:

In the next window, click on the Renew Profiles tab. There you’ll find the Deployment Profile waiting for the NGFW credits to be allocated. It is advisable to click on the left arrow (Step 2) to reveal deployment’s current Security Features – you might need this information for the next step.

When ready, click on the Renew icon (Step 3):

Take note of the Security Features enabled, and ensure they are identical in the next step to avoid being charged additional credits.

The Renew Deployment Profile will be displayed where you might notice a number of subscriptions enabled.  Clicking on the Calculate Estimated Cost (1) at the bottom, the new total is now 85.33, an increase of 30.59 credits!

To keep the credit consumption identical, deselect all unnecessary subscriptions.

When ready, click on the Renew Deployment Profile button:

After a few seconds, the main screen will update to show the allocated and consumed credits. The system will require a few minutes to fully update all information on the screen, however you can manually force an update by clicking the blue refresh icon located under the Credits Consumed/Allocated column:

Summary

This article explained how Palo Alto Networks NGFW or Flex credits are used to license software-based firewalls deployed in virtualization and cloud-based environments. We covered how software NGFW credits work, showed how to calculate required NGFW credits using the Palo Alto Networks Estimator tool, and how to renew an existing deployment profile.