Palo Alto Networks Grace Periods
This document defines Palo Alto Networks® grace periods for activation and entitlement of warranties, support contracts, and subscriptions. Grace periods exist to avoid penalizing our customers during the time it takes for hardware to ship, to clear customs if applicable, and to be received and processed at the destination. Grace periods do not apply to support contract renewals; support renewals always start at the end of the previous support contract regardless of any gap between the expiration date of the previous contract and the date on which the customer renews the support contract.
The policy defined in this document applies to all sales except stocking order sales to Palo Alto Networks authorized channels, for which the grace period begins on the day the distributor sells the product to a reseller as documented in the distributor’s point-of-sale (POS) reports. Additionally, products sold as part of a stocking order cannot receive warranty or support service and cannot have any subscriptions attached to them until the distributor provides the necessary POS data to Palo Alto Networks.
When an applicable grace period expires, Palo Alto Networks reserves the right to register the product (hardware or software) as well as activate support and any purchased attached subscriptions on behalf of the product owner without notification.
For the purposes of this policy, attached subscriptions are subscriptions attached to a Palo Alto Networks hardware or software appliance and include GlobalProtect™ network security for endpoints, WildFire® cloud-based threat analysis service, Threat Prevention, and URL Filtering. Term-based license offerings are not considered to be attached subscriptions.
Figure 1: Summary of the grace period policy, where North America covers the U.S. and Canada.
- Support contracts start either (i) at the time hardware is registered or (ii) 30 days after hardware is shipped when shipped to North America and 90 days after hardware is shipped when it is shipped outside North America, whichever is earlier.
Japan only: support contracts start either (i) at the time the authorization code is activated or (ii) 90 days after hardware is shipped, whichever is earlier.
- Attached subscriptions start when subscriptions are activated or 90 days after the delivery of the authorization code, whichever is earlier.
- Lab subscription and support bundles for end users as well as not-for-resale (NFR) subscription and support bundles for partners follow the support policy defined herein, which means support contracts and applicable attached subscriptions start on the same day.
The warranty start date for hardware is the same as the ship date. For software, the warranty start date is the same as the email delivery date of the authorization code. For additional information, refer to the Palo Alto Networks Product Warranty document located at https://www.paloaltonetworks.com/services/support/product-warranty.
The support contract start date is determined by the timing of the applicable hardware or software shipment but we provide a grace period—30 days in North America and 90 days outside North America—to allow for in-transit shipment time and end-user setup time. Support is similar to insurance in that, when active, it is in place to help if something goes wrong and, thus, it is important that support contracts start on the hardware or software shipment date. For details about support options, refer to the Global Customer Support Services Terms and Conditions at https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/support/global-customer-support-services-terms-conditions.pdf.
Important: The grace period for support contracts is based on the hardware ship date, not the delivery date of the support authorization code. For example, if a hardware appliance was shipped on January 1, 2011, and a support contract was purchased and applied to this appliance on May 1, 2011, the start date for support would be January 31, 2011 (30 days after the ship date). The start date would be earlier if the appliance was activated prior to January 31, 2011.
Attached subscriptions start either (i) at the time they are activated or (ii) 90 days after delivery of the authorization code, whichever is earlier, and they expire at the end of their subscription term even if you never activate the subscription. For example, a one-year attached subscription purchased on January 1, 2012, but never activated would still expire on March 31, 2013 (at the end of the 90-day grace period plus one year).
Additionally, attached subscription grace periods are determined by the delivery date of the authorization code(s)—not by the hardware ship date—and are 90 days long because attached subscriptions are product services that provide functionality only after they are activated. For example, if an appliance was shipped on January 1, 2018, and a Threat Prevention subscription was purchased on May 1, 2018, and activated on June 15, 2018, then the start date for the attached Threat Prevention subscription would be June 15, 2018 (because it is within the 90-day grace period that started on May 1, 2018, for the attached subscription).
Bundles—Excluding VM-Series Firewall
The support contract start date for support and subscription bundles, including lab and NFR bundles, follows the support contracts grace period model defined above, which means that support starts either (i) at the time the hardware or software appliance is registered or (ii) either 30 days after the hardware or software appliances is shipped within North America or 90 days after the hardware or software appliance is shipped outside North America, whichever is earlier.
Term-Based Licensed Offerings
Term-based licensed offerings (such as Endpoint Protection, AutoFocus™, Cortex Data Lake, Prisma Access, and Prisma SaaS) do not have grace periods. Terms for term-based licenses start on the email delivery date of authorization codes.
VM-Series Firewall Perpetual Bundles
All VM-Series firewall perpetual bundles do not have a grace period: support contracts and applicable attached subscriptions start on the email delivery date of authorization codes. This policy applies to VM-50, VM-100, VM-300, VM-1000-HV, VM-500, and VM-700 firewall perpetual bundles. Each bundle includes a VM-Series firewall perpetual capacity license, support contract, and zero or more attached subscriptions. All renewals of VM-Series firewall bundles start at the end of the previous bundle term regardless of any gap between the end of that previous term and the date that the bundle is renewed.
Enterprise Agreements do not have a grace period. Enterprise Agreements start (i) on the email delivery date of authorization codes or (ii) on the start date requested by the customer, whichever is later.