Sell Tool · Licensing
Software NGFW
Credit Estimator Walkthrough
One credit pool funds VM-Series, CN-Series, and Prisma AIRS across every hypervisor and public cloud. This is the seller's guide to reading, running, and defending the estimator output on a customer call.
Start Here
What This Calculator Actually Does
The estimator converts a target VM/container/AIRS configuration into a Software NGFW Credit total. Credits are Palo's reusable BYOL funding pool — one wallet, many deployments.
The Credit Model in One Line
A Software NGFW Credit is a pre-paid unit of Palo Alto software licensing. Customers buy a pool of credits, then draw from it to instantiate VM-Series firewalls, CN-Series containers, or Prisma AIRS — across Hyper-V, ESXi, KVM, AWS, Azure, GCP, and OCI. Reallocate freely as workloads move.
What the Estimator Adds Up
Instance credits (from vCPU count and instance count) + Subscription credits (CDSS bundles you attach) + Support credits (Premium Partner-Enabled, Premium, or Platinum). The Credits Summary panel totals these into a single number you can quote.
Why Sellers Use It
Sizing a hardware-to-VM migration, adding AIRS to an existing NGFW footprint, or renewing a mixed hypervisor + cloud estate — the estimator gives you a defensible credit target before you engage Palo desking. Output is stamped "Estimate only, contact Palo Alto Networks sales for a formal quote."
Walkthrough
Run the Estimator, Step by Step
Open the calculator in a second tab and follow along. Every field on the page maps to a decision you should already be having with the customer.
Pick the product family
The estimator covers three product lines that all draw from the same credit pool: VM-Series (virtual NGFW on any hypervisor or cloud), CN-Series (Kubernetes container firewall — remember CN-Series End-of-Sale is Nov 1, 2026, so size Prisma AIRS AI Runtime Firewall for anything new), and Prisma AIRS subscriptions. Set the product first — subscription options change based on it.
Enter Instances and vCPUs per instance
The two most important fields on the page: Instances and Number of vCPUs per instance. VM-Series sizing is driven by vCPU count, not memory and not destination hypervisor. Common vCPU steps: 2, 4, 8, 16, 22 — max is 64 vCPUs per deployment profile.
- Tie vCPU choice to a throughput target the customer will accept in writing — App-ID, Threat, TLS, IPSec numbers all scale with vCPUs.
- If replacing a PA-3020, a PA-5220, or similar hardware, use PANW's model-to-VM mapping guide to pick vCPUs — don't guess.
- Enable the Built-in Load Balancer (Hyperscale Security Fabric) option when the customer needs horizontal scale beyond a single VM.
Customize Subscriptions (CDSS)
The Customize Subscriptions section is where CDSS bundles get attached. Options include Advanced Threat Prevention, Advanced URL Filtering, Advanced WildFire, Advanced DNS Security, Enterprise DLP, IoT Security, SD-WAN, and the AI Security stack (AI App Protection, AI Model Security, AI Data Protection).
- Attach the same subscription list the customer runs on their hardware today — mismatched CDSS is the #1 source of "surprise" renewal deltas.
- AI subscriptions map to Prisma AIRS attach — this is where you introduce the AIRS story on a firewall renewal.
Add Management and Support
Under Management Options and Support Options, add Panorama for management and pick a support tier. Support is billed in credits, not dollars — it lives in the same pool.
- Premium Partner-Enabled — Optiv delivers L1/L2 and Palo covers L3. Best margin for partners.
- Premium — 24×7 direct-to-Palo. Default for most enterprise deals.
- Platinum — Named TAM plus faster SLAs. Position on large SecOps + NGFW estates.
Read the Credits Summary
The right-hand Credits Summary panel breaks the total into Instance(s), Support, and a subscription line, then a grand CREDITS figure. That number, multiplied by the customer's term (1 / 3 / 5 years) and Palo's per-credit rate, gets you to a ballpark ACV.
Watch The tool notes: "Estimate only, contact Palo Alto Networks sales for a formal quote." Also flagged on the page — customers with pre-Nov 1, 2024 credits will see different support and CDSS values because the model changed on that date. Never quote from the estimator alone on a renewal older than that.
Trigger the Subscription Incentive
Palo bakes an automatic discount into the estimator: buy enough subscription credits relative to firewall credits and the customer earns a rebate on subscriptions.
| Subscription credits vs firewall credits | Automatic subscription savings |
|---|---|
| ≥ 100% of Firewall credits | 12.5% off subscription credits |
| ≥ 120% of Firewall credits | 20% off subscription credits |
| ≥ 140% of Firewall credits | 25% off subscription credits |
Example from the tool: at 14 firewall credits, adding enough subscriptions to cross the 100% line saves 1.75 subscription credits automatically. Use this to justify attaching AIRS / AI subscriptions on the same order — the attach is partly self-funding.
Save and share the configuration
Use Save this configuration to persist the URL — send it to the account team so everyone works from the same estimate. The PDF of Common Configurations button is a good leave-behind for the customer's finance team. Then click GET CREDITS to route to Palo desking for a formal quote.
Reference
Most Popular Credit Configurations
Sizing anchors sellers actually use. The Firewall(s) credit values below come from Palo's own "PDF of Common Configurations" export from the estimator (14.00 credits for a 4 vCPU VM-Series with Advanced Threat Prevention, Premium 24 support = 21.48 total). Use these as reference points, then re-run the tool for the specific attach list.
VM-Series — Flex vCPU Sizing Anchors
| vCPUs | Legacy model | App-ID throughput | Sessions | Typical deployment | Firewall credits (per FW) |
|---|---|---|---|---|---|
| 2 | VM-100 | ~1.5 – 2 Gbps | 250K | Branch, small internet gateway, hybrid-cloud edge | Ask desking |
| 4 | VM-300 | ~3 – 4 Gbps | 800K | Mid-size internet gateway, segmentation, cloud VPC | 14.00 Palo published |
| 8 | VM-500 | ~8 Gbps | 2M | Virtualized DC, NFV, larger cloud edge | Ask desking |
| 16 | VM-700 | ~15 – 16 Gbps | 10M | Full DC, service provider, high-throughput cloud | Ask desking |
| 32 | — | ~20 Gbps | — | Hyperscale DC / multi-tenant | Ask desking |
| 64 (max) | — | ~31 Gbps | — | Deployment-profile ceiling | Ask desking |
Throughput/session figures are Palo published spec-sheet numbers (App-ID enabled, DPDK on GCP n2-standard reference instances). Actual credits depend on subscriptions and support tier — the 14.00 anchor is a real Palo-published output; other rows are shown as reference only because Palo does not publish a full per-vCPU credit table.
The Palo "reference" configuration Palo published
Straight from the estimator's "PDF of Common Configurations" export — this is the anchor to memorize.
| Line | Selection | Credits |
|---|---|---|
| Series | VM-Series, 1 firewall, 4 vCPUs | 14.00 |
| Subscriptions | Advanced Threat Prevention | 4.20 |
| Management | Strata Cloud Manager Pro + Strata Logging Service (no Panorama) | 0.00 |
| Support | Premium 24 | 3.28 |
| Total | Per year | 21.48 |
Small branch / cloud edge — 2 vCPU with basic CDSS
Segmentation firewall, branch internet gateway, single VPC. Attach a lean CDSS stack, keep management on SCM.
- Instance: 1 × VM-Series, 2 vCPUs
- Subscriptions: Advanced Threat Prevention + Advanced URL Filtering
- Management: Strata Cloud Manager Pro
- Support: Premium Partner-Enabled (Optiv L1/L2) or Premium 24
- Sizing tip: Delivers ~1.5–2 Gbps App-ID throughput, 250K sessions — plenty for a branch or small VPC.
Standard cloud VPC — 4 vCPU with full CDSS + AIRS attach
The most common new-deal shape. Anchors on the 14.00 published firewall credit line and pulls the subscription incentive to help fund the AIRS attach.
- Instance: 1 × VM-Series, 4 vCPUs (14.00 credits)
- Subscriptions: Advanced Threat Prevention, Advanced URL Filtering, Advanced WildFire, Advanced DNS Security, + AI App Protection, AI Model Security, AI Data Protection
- Incentive play: attach enough subscriptions to cross 100% of 14 firewall credits → auto-save 12.5%. Push to 120% for 20% off.
- Support: Premium 24 (3.28 credits published)
- Where sellers land this: a VM-Series renewal where the customer is already planning to deploy internal LLMs or agentic apps — AIRS attach becomes the expansion story on top of the firewall renewal.
Data center / NFV — 8 or 16 vCPU pair for HA
Full DC or virtualized service-provider edge. Almost always a pair for HA — put both in the estimator.
- Instance: 2 × VM-Series, 8 vCPUs (VM-500 class, ~8 Gbps, 2M sessions) or 16 vCPUs (VM-700 class, ~15 Gbps, 10M sessions)
- Subscriptions: full CDSS bundle (ATP, AURL, AWF, ADNS, DLP, IoT Security if OT/medical)
- Management: Panorama (virtual, funded by same credit pool) + Strata Logging Service
- Support: Premium 24 or Platinum for named TAM
- Where sellers land this: DC refresh replacing PA-5220 / PA-5250 / PA-5450 hardware. Use the credit model to future-proof mobility to Azure/AWS without re-buying.
Prisma AIRS — how to size it
No public per-unit credit table Palo does not publish AIRS credit rates the way it publishes VM-Series vCPU sizing — every AIRS estimator run has to go through Palo desking for the final number. That said, sellers can scope it cleanly by asking the right questions up front:
- AI Runtime Security — sized by the number of AI applications / LLM endpoints the customer wants inspected inline (chatbots, RAG apps, agent frameworks). Ask: how many prod-facing AI apps, how many API endpoints, what's the request volume?
- AI Model Security — sized by the number of models the customer needs to scan (weights, containers, artifacts). Ask: how many custom or fine-tuned models, how many third-party models pulled from HuggingFace / model hubs?
- AI Agent Security — sized by the number of agents and MCP servers. Ask: how many agent frameworks in production (LangChain, LlamaIndex, Autogen, homegrown), how many MCP servers exposed?
- AI Data Protection (inc. Enterprise DLP) — the AIRS subscription line that appears directly in the estimator's Customize Subscriptions panel. Attaches to VM-Series or CN-Series just like any other CDSS.
- AI Red Teaming — usually engagement-based, priced separately through Unit 42 or as a services attach.
- Portkey AI Gateway — folded into AIRS 3.0 licensing; no separate SKU to size.
Selling motion: use the VM-Series line as the anchor, add the three AI subscriptions in the estimator's Customize Subscriptions panel to trigger the 12.5% / 20% / 25% incentive, then engage the Palo AIRS specialist for the standalone AIRS Runtime / Model / Agent sizing on top. Never quote AIRS from the estimator alone.
CN-Series / AI Runtime Firewall — for containers
CN-Series EOS Nov 1, 2026 Size Prisma AIRS AI Runtime Firewall for any new Kubernetes protection. Same credit pool. Sized by number of protected Kubernetes clusters and node/pod count — Palo desking owns the conversion factor. Existing CN-Series footprints renew normally through the same credit model.
Applying the Subscription Incentive to Your Configuration
On the 4 vCPU reference config (14.00 firewall credits), here's what each incentive tier looks like:
| Tier | Subscription credits needed | Auto-savings on subs | Selling motion |
|---|---|---|---|
| Baseline | Any amount < 14.00 | 0% | ATP only — minimum viable posture |
| 100% | ≥ 14.00 credits | 12.5% off | Full CDSS (ATP + AURL + AWF + ADNS) |
| 120% | ≥ 16.80 credits | 20% off | CDSS + Enterprise DLP or IoT Security |
| 140% | ≥ 19.60 credits | 25% off | CDSS + DLP + IoT + full AI subscription stack (AIRS attach) |
The 140% tier is where AIRS attach nearly pays for itself on the subscription line — this is the strongest platform-expansion motion the estimator gives you.
Positioning
Why This Matters for Sellers
The estimator isn't just a pricing tool — it's the frame that keeps a customer's licensing conversation clean.
One pool, many destinations
- Replacing a PA-3020 with a mix of Hyper-V and Azure VM-Series? Same credit pool — don't let the customer treat Azure as "cloud credits" and Hyper-V as "regular licensing."
- Marketplace PAYG (AWS / Azure / GCP) is a separate billing path and does not cover on-prem hypervisors.
- Credits are reusable — a VM can move between Hyper-V, ESXi, and Azure without buying new licenses.
Renewal defense
- Never quote a renewal from the estimator alone — pre-Nov 1, 2024 credits carry different support and CDSS values.
- Use the estimator to model the new-state and compare against the customer's remaining unused credits.
- CN-Series is EOS Nov 1, 2026 — for anything new, size Prisma AIRS AI Runtime Firewall instead. Same credit pool applies.
AIRS attach on every firewall deal
- AI App Protection, AI Model Security, and AI Data Protection all sit inside the estimator's subscription list.
- Add them to hit the 100% / 120% / 140% subscription threshold — the auto-discount (12.5% / 20% / 25%) partially offsets the AIRS add.
- Land the AIRS story on the licensing motion, then expand to the full Prisma AIRS 3.0 agentic AI security stack (AI Runtime Security, AI Agent Security, AI Red Teaming, AI-SPM).
Partner economics
- Pick Premium Partner-Enabled support when Optiv is delivering L1/L2 — best margin path.
- Credits are a NextWave-eligible SKU family — deal registration and CPQ still apply. See Deal Playbook.
- Use Save this configuration to hand the URL to Palo desking and the customer's finance team on the same email.
FAQ
Answers You Need in the Call
"How is this different from the hardware line?"
Hardware NGFWs are appliance SKUs — one box, one license. Software NGFW Credits are a reusable wallet that funds virtual and container firewalls across every hypervisor and cloud. Same PAN-OS, same subscriptions, different procurement vehicle.
"What's a credit worth in dollars?"
Palo doesn't publish a fixed per-credit rate — pricing runs through Palo desking and reflects deal size, term, and NextWave incentives. The estimator is deliberately unit-only. Get the credit target first, then let desking convert to ACV.
"What if the customer's VMs move between clouds?"
That's exactly what the credit model is designed for. Credits sit in the customer's account; a VM-Series firewall moving from Hyper-V to Azure or resizing from 4 to 8 vCPUs just re-draws from the same pool. No new SKU, no new PO for the move itself.
"Do subscriptions on VM-Series match the hardware bundles?"
Same CDSS catalog — Advanced Threat Prevention, Advanced URL, Advanced WildFire, Advanced DNS, Enterprise DLP, IoT Security, SD-WAN, and the AI security subscriptions. Attach the same list the customer runs on their appliances to keep the security posture identical.
Open the estimator and run your scenario
Bring the URL back to the account team, then hand off to Palo desking with Save this configuration. Pair with the Deal Playbook for registration and NextWave mechanics.