11.2 CDSS Subscriptions, Premium GlobalProtect & License Lifecycle
Key Takeaways
- Each Cloud-Delivered Security Service is separately licensed, and the Advanced tiers differ from their legacy predecessors by adding real-time inline analysis: Advanced URL Filtering over PAN-DB lookups and Advanced Threat Prevention over signature-only IPS.
- Basic GlobalProtect needs no subscription, but the annual GlobalProtect subscription is required for HIP checks and HIP content updates, mobile app support on iOS, Android, and Chrome OS, IPv6, clientless VPN, and split tunneling by destination domain or application.
- When a subscription expires the firewall keeps enforcing with the last installed content while updates and cloud lookups stop, so protection decays silently rather than failing visibly.
- The Applications content package is delivered to every firewall without a subscription; only the threat portion of Applications and Threats requires an active Threat Prevention or Advanced Threat Prevention license.
- Prisma Access is licensed by consumption unit — Mobile User units per user, NET units for remote network bandwidth, site-based licensing for headless devices — plus add-ons such as Prisma Browser, RBI, CASB-X, and Enterprise DLP.
11.2 CDSS Subscriptions, Premium GlobalProtect & License Lifecycle
Why Licensing Is a Blueprint Topic
Blueprint task 3.2 enumerates the Cloud-Delivered Security Services components by name, task 5.1 asks about "the function of Security policies, profiles, and updates in the configuration and maintenance of CDSS," and task 4.1 covers "updates, upgrades" on the firewall platforms. Between them, they require you to know what each subscription unlocks, where it is enforced, and what stops working when it lapses. NetSec-Pro items regularly present a symptom — a feature silently not working — whose answer is a missing or expired subscription rather than a misconfiguration.
The CDSS Catalogue
| Subscription | What it unlocks | Enforced through | Symptom when absent or expired |
|---|---|---|---|
| Advanced Threat Prevention | Signature-based IPS plus inline deep-learning detection of unknown command-and-control traffic | Vulnerability Protection and Anti-Spyware profiles | Signature IPS may still run from the last installed content, but inline cloud analysis of novel C2 stops |
| Advanced WildFire | Cloud sandbox verdicts plus inline ML models on the dataplane | WildFire Analysis and Antivirus profiles | Unknown files are forwarded but no verdict returns; real-time signature streaming stops |
| Advanced URL Filtering | Real-time, inline analysis of previously unseen URLs on top of the PAN-DB category database | URL Filtering profile | Categorisation falls back to cached PAN-DB; newly weaponised URLs are missed |
| Advanced DNS Security | Real-time inline inspection of DNS queries and responses, DGA and DNS-tunnelling detection, sinkholing | Anti-Spyware profile, DNS Security section | DNS signatures age out; no live cloud lookups |
| Enterprise DLP | Inline and API data patterns and data profiles | Data Filtering profile, SaaS Security | No data profile evaluation |
| SaaS Security / CASB-X / CASB-PA | Inline discovery, Data Security (API), SSPM | Strata Cloud Manager (section 4.5) | No SaaS discovery or posture scanning |
| Device Security (IoT) | Machine-learning device identification, Device-ID mappings, policy recommendations | Strata Cloud Manager (section 4.4) | Empty device inventory; Device-ID objects cannot be populated |
| GlobalProtect subscription | The advanced GlobalProtect capabilities listed below | GlobalProtect portal and gateway | HIP checks and mobile clients stop working; basic VPN continues |
| SD-WAN subscription | PAN-OS SD-WAN on the firewall; Advanced SD-WAN for NGFW for the advanced feature set | Panorama SD-WAN plugin (section 8.4) | No SD-WAN policy rules or path selection |
| AIOps for NGFW (Free / Premium) | Best Practice Assessment, posture scoring, capacity forecasting; Premium adds the fuller feature set | Strata Cloud Manager (section 7.4) | Reduced or no posture insight |
The Precision AI bundle packages the advanced CDSS services together and is also one of the documented entitlement paths for Device Security.
Exam Trap Alert: Distinguish the legacy services from their Advanced successors. URL Filtering is category lookup against PAN-DB; Advanced URL Filtering adds real-time inline analysis of never-before-seen URLs. Threat Prevention is signature IPS; Advanced Threat Prevention adds inline deep learning for unknown C2. A scenario describing a zero-day phishing page that is correctly blocked on first encounter is describing the Advanced tier.
Premium GlobalProtect: What the Subscription Actually Buys
The blueprint lists Premium GlobalProtect as a CDSS component. The key fact is that basic GlobalProtect is not licensed — you can deploy a portal and a single gateway and connect Windows and macOS agents with no subscription at all. The annual GlobalProtect subscription is what unlocks the advanced capabilities:
| Capability | Requires the GlobalProtect subscription |
|---|---|
| HIP checks and the associated HIP content updates | Yes |
| GlobalProtect mobile app support (iOS, Android, Chrome OS) | Yes |
| IPv6 support | Yes |
| Clientless VPN | Yes |
| Split tunnel based on destination domain, application, or HTTP/HTTPS video streaming | Yes |
| Basic agent VPN from Windows and macOS to a single gateway | No |
This is a favourite exam construction: an organisation deploys GlobalProtect successfully, then adds a HIP-based access rule (section 9.2) and finds it never matches. The cause is the missing subscription, not the HIP profile.
License Activation and Verification
# Retrieve licenses after entering auth codes in the Customer Support Portal
admin@PA-3410> request license fetch
# Offline / air-gapped activation using a downloaded key file
admin@PA-3410> request license install
# Show installed licenses, features, and expiry dates
admin@PA-3410> request license info
# Confirm the device serial and support status
admin@PA-3410> show system info
In the web interface the same view is Device > Licenses, and Panorama can retrieve and push licenses to managed firewalls centrally.
Expiry Behaviour
The distinction that matters operationally is between enforcement and currency:
- Already-installed content keeps enforcing. A firewall with an expired Advanced Threat Prevention subscription does not stop inspecting; it keeps using the last content package it successfully installed.
- Updates and cloud lookups stop. No new signatures, no new App-IDs from threat content, no real-time cloud queries. Protection quietly decays rather than failing loudly, which is precisely why it is dangerous.
- Cloud-delivered features fail outright where the feature is the cloud call — Advanced URL Filtering's real-time verdicts, WildFire submissions, Advanced DNS lookups.
Content Updates and Their License Dependencies
Section 10.3 covered the dynamic content update lifecycle, threshold hold times, and the "Disable new apps in content update" safeguard. The licensing angle completes it:
| Content package | Requires | Notes |
|---|---|---|
| Applications only | No subscription | App-ID definitions are delivered to every firewall |
| Applications and Threats | An active Threat Prevention or Advanced Threat Prevention subscription for the threat portion | Without it you receive application content only |
| Antivirus | Threat Prevention / Advanced WildFire | Hourly stream-based signatures |
| WildFire | WildFire / Advanced WildFire | Near-real-time verdict signatures |
| URL Filtering (PAN-DB) | URL Filtering / Advanced URL Filtering | Database updates plus cloud lookups |
| Device-ID Content | Device Security | Device dictionary attributes usable in policy |
| GlobalProtect Data File | GlobalProtect subscription | HIP object definitions for host checks |
Exam Trap Alert: App-ID content is not gated behind Threat Prevention. If a scenario says a firewall with no security subscriptions cannot identify a newly released application, the fix is to install the Applications content update, not to buy a licence.
Prisma Access Licensing Units
Prisma Access is licensed by consumption unit rather than by appliance, and the units appear in exam scenarios about scaling:
| Unit | Covers |
|---|---|
| Mobile User unit | One remote user connecting by GlobalProtect agent, agentless SAML or Kerberos explicit proxy, or proxy mode on the agent |
| NET / remote network bandwidth units | Aggregate bandwidth allocated across remote network sites |
| Site-based licensing | Headless devices at a site that cannot be counted as named users |
| Add-on licenses | Prisma Browser, Remote Browser Isolation, CASB-X / CASB-PA, Enterprise DLP |
Section 5.2 covered how remote network bandwidth is allocated per site and per compute location; the licensing model is why that allocation matters commercially as well as technically.
Maintenance Discipline
Bringing the maintenance tasks of blueprint domain 4 together into a single operating rhythm:
Daily : verify content update install success; review failed downloads
Weekly : review AIOps/BPA posture score and act on new findings
Monthly : audit Device > Licenses (or Panorama) for expiry within 90 days
Quarterly : review PAN-OS maintenance release notes; schedule HA-pair upgrades
Annually : renew subscriptions ahead of expiry; re-baseline the rulebase
The single highest-value control on that list is the licence expiry audit, because a lapsed subscription produces no alarm on the data path — traffic keeps flowing and rules keep matching, while the quality of the verdict behind them silently degrades.
An administrator deploys a GlobalProtect portal and gateway, and Windows agents connect successfully. A new Security policy rule that matches on a HIP profile requiring disk encryption never matches any traffic. Licensing on the firewall shows Advanced Threat Prevention and Advanced URL Filtering as active. What is the most likely cause?
A firewall's Advanced URL Filtering subscription expired three weeks ago and has not been renewed. What is the expected behaviour?
A firewall with no security subscriptions at all cannot identify a newly released collaboration application and classifies its traffic as web-browsing. What is the correct remediation?