What are Palo Alto Networks Software NGFW Credits & How Do They Work?
Palo Alto Networks Software credits give an easy, flexible way to buy a bucket/pool of credits and spend them however you want across different platforms (VM, CN, AI) and infrastructure.
This guide explains Palo Alto Networks Strata NGFW (Next-Generation Firewall) Credits and how they work. Let's start with frequently asked questions about this flexible licensing system.
Frequently Asked Questions
What are NGFW Credits or Flex Credits?
NGFW Credits are a flexible way to license Palo Alto Networks Software NGFW products. The Software NGFWs fall into three groups:
VM-Series – You can spin them up on-prem using ESXi, Hyper-V, or KVM or in cloud spaces such as AWS, Azure, and GCP.
CN-Series – There are container-based firewalls that can protect your Kubernetes nodes/hosts in a cluster.
AI Runtime Security – is an AI firewall. It protects your Large Language Model (LLM) in the cloud.
You get credits in your credit bucket and can spend them on any of these Software Strata firewalls based on your needs.
Common Use Cases
VM-Series:
Cloud-based VM security
Datacenter segmentation
Remote branch protection
CN-Series:
Kubernetes workload protection
Microservices security
AI Runtime Security:
LLM deployment protection
AI model security
How many credits do I need?
Your credit requirements depend on several factors:
Firewall type
vCPUs (horsepower)
Subscriptions (IPS, URL Filtering, DNS Security, etc.)
Management options (Panorama, Strata Cloud Manager, and Strata Logging Service)
Support options
The best way to find out how many credits you need is to use the Software NGFW Credit Estimator. This is a web-based tool that gives you an estimate.
What is the minimum number of credits I should buy?
No minimum requirement exists. Theoretically, you can buy one credit, but in reality, you cannot do anything with one credit.Typical starting deployments usually require 50 or more credits.
How much do credits cost?
It depends! – I know, I wish I had a better answer – Contact a Palo Alto Networks regional partner/account manager for a quote. If you are a business in Canada, you can contact us at sales@PaloXperts.com for a customized quote.
Do these credits expire?
Yes. Credits expire 12 or 36 months after purchase, regardless of usage. To avoid unused credits, it's essential to accurately estimate your needs.
Do I get a volume-based discount?
Yes. You qualify for credit discounts when your subscription credit spending equals or exceeds your firewall credit spending. For example, if you spend 30 credits on a firewall, you'll become eligible for discounts once your subscription credit spending reaches or exceeds 30 credits.
Depending on the deal size, you might also receive a discount from the resale partner.
Step-by-Step Deployment Process
1. Evaluation (optional but recommended)
Before purchasing credits, request a trial/evaluation credit to test the system. Contact us at sales@PaloXperts.com for evaluation credits and setup assistance.
Typical evaluation period: 30 days
2. Create a CSP account
Create a Palo Alto Networks support portal account if you don't already have one. This account will be crucial for managing your credits and deployments.
Setup time: 5-15 minutes
3. Purchase and Activation Email:
After completing the purchase:
You'll receive an activation email with an "Activate" button
Clicking it directs you to your support portal
Activate and allocate credits to your desired tenant account
Processing time: 1-2 business days
See the screenshots below:
4. Verification
Verify your credits in the support portal. Credits end up in a pool (bucket) with a particular Pool ID.
5. Create Deployment Profiles
Deployment profiles give you a way to subgroup group your software firewalls around certain characteristics such as:
Firewall type
Number of instances
Feature sets for each firewall group
Example profile structure:
Profile name: "AWS/VM/Prod"
Purpose: VM firewalls in the AWS production environment
Features: URL Filtering, IPS, DNS security, Strata Cloud Manager
Below, you can see a screenshot of two sample profiles:
6. Register Your Firewalls
Registration methods vary by firewall type and platform. Consult Palo Alto Networks documentation or contact us for any support.
Estimated basic setup: 2-4 hours
Below is an example of a successfully registered firewall on AWS.
7. Optional: Panorama Licensing
You can use credits to license Panorama and Panorama log collectors. Note that many organizations now prefer Strata Cloud Manager over Panorama, which only requires licensing on the firewall side.
8. Credit Management
To free up credits:
Access your firewall management interface
Select the firewall(s) to deactivate
Follow the deactivation process
Verify credit release in your pool
Reassign freed credits as needed
You can also transfer credits to another account/tenant
Common Deployment Pitfalls to Avoid
Underestimating credit needs
Not accounting for credit expiration
Overlooking subscription requirements
Insufficient testing in evaluation phase
Next Steps
Assess your security requirements
Request an evaluation if needed
Calculate credit requirements
Contact a partner for pricing
Begin deployment planning
Post Summary
Palo Alto Networks Software credits give an easy, flexible way to buy a bucket/pool of credits and spend them however you want across different platforms (VM, CN, AI) and infrastructure (on-prem, AWS, Azure, GCP)
About us – PaloXperts
As an official Palo Alto Networks partner, we provide PAN products and professional services in the US and Canada.
Please contact us at info@PaloXperts.com.