Feature is configured and no valid license backs it
At a glance
Base severity
Area
Platform
Evidence level
Benchmark reference
Reads the export, not the device
ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.
Why it matters
A feature that needs a subscription does not receive the content updates or cloud lookups it depends on once the subscription is missing or has ended. The configuration still shows it as switched on, so nobody sees it stopped working.
How to fix it
Web interface
The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.
- Renew or add one of the licenses named in the finding, or remove the feature from the rules that use it.
- Activate the license on the device and read it again to confirm it now appears with a future end date.
Command line
PAN-OS CLI
request license fetch auth-code <auth-code>An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits. Review the candidate configuration, then commit it yourself.
Read it back
request license infoValues to fill in1
- <auth-code>
- The authorization code that came with the license purchase
Before you type it1
- Type these in operational mode, not configuration mode. A purchase comes with an authorization code, which no configuration holds.
How to confirm the fix
- Read the device's licenses again and confirm the license is listed with an end date in the future.
- Check that the feature's content database shows a recent update after the license is active.
Limits
- The license reading shows what the device holds on the day it was read. It does not show whether the feature works today.
- Two licenses can unlock some features. The finding fires only when none of the listed ones is valid.
Compliance references
No benchmark recommendation is mapped to this control in this version.
More in Security Profiles
- PAN-SEC-088Anti-spyware profile sinkholes DNS queries to no address
- PAN-SEC-099Vulnerability protection profile does not block critical or high severity
- PAN-SEC-100Anti-spyware profile does not block every severity
- PAN-SEC-133WildFire file size limit is below the documented default
- PAN-SEC-135WildFire session information is not all sent
- PAN-SEC-136Antivirus profile does not reset both sides on every decoder
- PAN-SEC-137URL filtering profile allows categories without logging
- PAN-SEC-138URL filtering profile does not log every HTTP header field
See it on your own firewall
One complete analysis of one firewall costs nothing. A card is required and nothing is charged.