Licensing and entitlements

Overview

The License and Entitlements page provides a unified view of your F5 Insight license status, validity, and storage consumption. Use this page to monitor your entitlements and track storage utilization across telemetry data and application logs.

Benefits and key features

  • License visibility — Quickly verify your license status, expiration date, and operating mode from a single dashboard.
  • Storage monitoring — Track real-time storage consumption to understand capacity utilization and plan accordingly.
  • Capacity planning — View storage breakdown by data type using current and historical data to identify growth trends and anticipate future needs.

Access license information

  1. Go to System Management > License.

    The F5 Insight License and Entitlements page opens.

License information

Field Description
Status Current license state (Active, Expired, and so on)
Valid until License expiration date
Mode Connection mode (Connected or Disconnected)

License modes

  • Connected — F5 Insight validates your license against F5 cloud services with outbound connectivity to F5 licensing endpoints.

    1. F5 Insight generates a license report containing required host and license data.
    2. The license report is sent automatically to the F5 licensing server for validation.
    3. The F5 licensing server returns a signed license report that entitles the device.

  • Disconnected — Uses the same validation workflow for air-gapped environments, but data transfer is manual.

    1. F5 Insight generates the same license report containing required host and license data.
    2. You manually transfer and submit the license report to the F5 licensing server from a connected system (using a tool like Postman or curl).
    3. You manually upload the signed license report returned by F5 back to the device to complete entitlement.

    Note

    A helper tool is available to assist with the manual transfer and submission process for disconnected workflows. See the Disconnected mode helper tool section below for details.

Licensing workflows and best practices

This section describes common licensing lifecycle scenarios and recommended actions for each.

Extending trial licenses

Trial licenses are limited to 30 days. F5 Insight does not enforce this limit in 1.x.x or the upcoming 2.0.x releases, so the product continues to function after the trial expires.

Don’t deactivate and reactivate a trial license to extend the evaluation period. You can’t replace an existing trial or paid license with another trial license. To continue with a paid license, use Switch an F5 Insight license. You don’t need to wait for trial expiration.

Migrating from trial to paid license

Use Edit License > Switch License to replace an active or expired trial license with a paid license on the same instance. You don’t need to deactivate the trial, wait for expiration, or have Support remove an expired trial first.

The switch preserves connected or disconnected mode. Follow the corresponding procedure in Switch an F5 Insight license.

Trial-to-paid license workflow
License state Next action
Trial active Switch directly to a paid license. Don’t wait for trial expiration.
Trial expired Switch using the new paid license JWT.
Paid license active Verify the new license as described in Verify the new license.

Moving devices between environments

When migrating a device from one environment to another (for example, staging to production), deactivate the license on the old device and activate it on the new device to avoid double billing.

Switch License replaces a license on the same instance. It doesn’t move a license to another instance.

Device migration workflow
Step Old Device (Source) New Device (Destination)
Pre-migration License: Active JWT available
Action Deactivate license —
Activate — Activate using same JWT
Result No license License: Active

Licensing in disaster recovery setups

In a disaster recovery (DR) deployment with a primary and standby F5 Insight instance, activate the license only on the primary device. The standby instance does not require a separate license activation.

When you promote the standby instance to primary (failover):

  1. The promoted instance inherits the license from the replicated configuration.
  2. The license remains active on the newly promoted primary device.
  3. After you repair and restore the original primary to standby role, you do not need to reactivate licensing.

For more information, see Configure disaster recovery.

Deactivation requirements and constraints

Use deactivation when you need to remove a license, such as before moving it to another instance.

Important

Don’t deactivate the current license before replacing it with a paid license on the same instance. Use Switch an F5 Insight license instead. Switching supports active or expired trial and paid licenses. It doesn’t extend a trial or support replacement with a trial license.

Before deactivating a license, make sure you meet the requirements for its connection mode.

Requirement Details
Connected mode The device must have outbound connectivity to F5 licensing servers at the time of deactivation.
Disconnected mode handshake If using disconnected licensing, you must complete the manual report submission workflow after deactivation.

Deactivation workflow for connected mode:

  1. Go to System Management > License.
  2. Verify the device has outbound connectivity to F5 licensing servers.
  3. Select Deactivate on the active license JWT.
  4. F5 Insight sends a deactivation request to the F5 licensing server.
  5. Deactivation is confirmed; the license transitions to inactive.

Deactivation workflow for disconnected mode:

In disconnected licensing mode, deactivation requires manual submission to the F5 licensing server:

  1. Go to System Management > License.
  2. Select Deactivate on the active license JWT.
  3. F5 Insight generates a deactivation report.
  4. Manually transfer the deactivation report to the F5 licensing server from a connected system.
    1. Use the helper tool or API to submit the report (see Disconnected mode licensing tool).
    2. The F5 licensing server returns a signed acknowledgment.
  5. Upload the signed acknowledgment back to the device to complete the deactivation workflow.

Important

For disconnected licensing deactivation to complete successfully, you must receive and upload the signed acknowledgment from the F5 licensing server. Without this step, the device remains in a transitional state.

Switch an F5 Insight license

Use Switch License to replace the license on an existing F5 Insight instance with a paid license. You can switch from a trial license to a paid license, or from one paid license to another. The current license can be active or expired.

You don’t need to deactivate the current license before switching. An active trial doesn’t need to expire before you switch to a paid license.

The switch preserves the current connection mode:

  • Connected — F5 Insight exchanges licensing reports with F5 licensing services automatically.
  • Disconnected — You download a report, submit it to F5 licensing services from a connected system, and upload the returned signed acknowledgement to F5 Insight.

Important

Switching licenses doesn’t extend a trial. You can’t switch an existing trial or paid license to a trial license.

Supported license transitions

Current license New license Supported Action
Active trial Another trial No Obtain a paid license instead.
Expired trial Another trial No Obtain a paid license instead.
Active trial Paid Yes Switch directly. Don’t wait for trial expiration.
Expired trial Paid Yes Switch using the new paid license JWT.
Active paid Another paid Yes Switch using a different paid license JWT.
Expired paid Another paid Yes Switch using a new valid paid license JWT.
Active or expired paid Trial No Use a paid license.

The supported transitions use the same procedure for the instance’s connection mode. For example, after switching an expired trial to a paid license, you can later switch that paid license to another paid license.

Before you begin

  • Obtain a valid JSON Web Token (JWT) for the new paid license from your F5 account team.
  • Sign in with an account that can view and modify license management settings.
  • Confirm that the existing license is shown as Active or Expired. Switch License isn’t available for an inactive license or a license that is terminating.
  • Check the Mode on the license page and follow the corresponding procedure below.
  • For connected mode, make sure the F5 Insight instance can reach F5 licensing services.
  • For disconnected mode, have access to a separate connected system to submit the report and retrieve the signed acknowledgement.
  • Complete any licensing operation already in progress before starting another switch.

Note

This procedure replaces a license on the same F5 Insight instance. It isn’t the procedure for moving a license to a different instance or upgrading F5 Insight Light to F5 Insight.

Access the switch license dialog

  1. Navigate to System Management > License. The F5 Insight License and Entitlements page opens.
  2. Review Status, Valid Until, and Mode.
  3. Select Edit License.
  4. In the Edit License panel, locate License Token and select Switch License.

The Switch License dialog opens with a JWT Token field. The dialog identifies the current connection mode and indicates that the switch preserves it.

Switch a license in connected mode

Use this procedure for an active or expired trial-to-paid or paid-to-paid transition when Mode is Connected.

  1. Open the Switch License dialog as described above.
  2. In JWT Token, paste the JWT for the new paid license.
  3. Select Switch License.
  4. Wait for F5 Insight to process the request and complete the licensing report exchange. No manual report download or upload is required.
  5. Confirm that the dialog displays Switch license completed successfully. The dialog closes automatically, and F5 Insight refreshes the license information.
  6. Verify the new license as described in Verify the new license.

Wait for the success message before considering the switch complete. If an error appears, review the message and follow the Troubleshooting section.

Switch a license in disconnected mode

Use this procedure for an active or expired trial-to-paid or paid-to-paid transition when Mode is Disconnected.

Generate and download the report

  1. Open the Switch License dialog.
  2. In JWT Token, paste the JWT for the new paid license.
  3. Select Switch License.
  4. Wait for License switch config report generated successfully.
  5. Select Download License Report. F5 Insight downloads a JSON file named license-switch-report-YYYY-MM-DD.json and displays Upload Signed Acknowledgement.

Submit the report to F5 licensing services

  1. Transfer the report to a connected system.
  2. Submit the report to F5 licensing services using the new paid license JWT. For the existing helper workflow, see Disconnected mode licensing tool:
    1. Open the helper app.
    2. Upload the downloaded license-switch report.
    3. Paste the new paid license JWT.
    4. Select Generate curl and run the generated command on the connected system.
    5. Retrieve the signed manifest response, saved by the helper-generated command as license-manifest-YYYY-MM-DD.json.

Upload the signed acknowledgement

  1. Transfer the signed acknowledgement back to the system used to access F5 Insight.
  2. In the Switch License dialog, select Acknowledgement File and choose the returned file. The UI accepts .json or .xml files containing the signed manifest. Use Change File if you selected the wrong file.
  3. Select Verify & Complete Switch.
  4. Confirm that the dialog displays Switch license completed successfully. The dialog closes automatically, and F5 Insight refreshes the license information.
  5. Verify the new license as described in Verify the new license.

Important

Generating or downloading the report doesn’t complete the disconnected switch. You must submit the report to F5 licensing services and successfully verify the returned signed acknowledgement in F5 Insight. Upload the response from F5, not the original report. F5 licensing services sign the acknowledgement — you don’t sign it yourself.

Resume a pending disconnected verification

If you close the switch dialog before completing the report exchange:

  1. Return to the license page and select Edit License.
  2. If the pending report actions are available, select Download Report to obtain the report if needed.
  3. Complete the submission to F5 licensing services and retrieve the signed acknowledgement.
  4. In Edit License, select Verify Report.
  5. Choose the returned file in Acknowledgement File, then select Upload & Verify.
  6. After verification succeeds, review the refreshed license information.

These report actions appear when a disconnected report is ready or verification is pending or has failed. If they aren’t available, review the current license status and any error before starting another operation.

Verify the new license

After the switch completes:

  1. On the F5 Insight License and Entitlements page, confirm that Status is Active.
  2. Check that Valid Until reflects the new paid license.
  3. Confirm that Mode hasn’t changed.
  4. Open Edit License and check License Token against the new license’s token identifier.
  5. Review the licensed storage capacity and applicable entitlements.

If refreshing the license information fails, reload the page and verify the current state before retrying the switch.

Troubleshooting

Issue Cause Resolution
Edit License or Switch License is disabled Insufficient permissions, or an appliance mode upgrade is in progress. Verify that your account has permission to modify license management settings. Wait for any in-progress operation to finish.
Switch License isn’t shown The current license is inactive or terminating, or you are in the F5 Insight Light upgrade flow. Switch License is available for Active and Expired licenses only. Check the current license state.
JWT is missing or has an invalid format The JWT field is empty or contains an incomplete token. Enter the complete new paid license JWT in JWT Token. Resolve field validation errors before submitting.
A trial token is rejected A previously activated instance can’t be switched to another trial license. Use a paid license JWT.
A licensing operation or switch is already in progress Another licensing operation hasn’t completed. Wait for the operation to finish. If a disconnected acknowledgement is pending, complete that report exchange.
Same JWT as the current license was submitted Resubmitting the current token doesn’t replace the license. Check the token identifier and use a different paid license JWT.
F5 Insight can’t connect to licensing services Outbound connectivity from F5 Insight (connected mode) or from the report-submission system (disconnected mode) is blocked. Check the required outbound connectivity.
The acknowledgement file is rejected The uploaded file isn’t the signed response from F5 licensing services, or it’s missing the required manifest field. Upload the signed response returned by F5 licensing services. A JSON response must contain a manifest field. An XML response must contain a manifest element. Don’t upload the outbound report.
Verification fails The acknowledgement doesn’t belong to the current report exchange, or the file is corrupted. Confirm that the acknowledgement matches the current report exchange. Select the correct file and retry verification. Contact F5 Support if the error persists.

If an issue persists, contact F5 Support and include a support bundle. See Generate a support bundle.

Storage

The storage section provides a real-time overview of data consumption against your licensed capacity.

Storage metrics

Metric Description
Storage in use Total storage currently consumed
Licensed storage Maximum storage included in your license
Available storage Remaining capacity

Storage breakdown by data type

Storage consumption is categorized by:

  • Telemetry data — Metrics and performance data collected from BIG-IP devices.
  • Application logs — Log data ingested from your BIG-IP fleet.

Storage retention behavior

When storage utilization reaches capacity, F5 Insight automatically rolls over data by deleting the oldest records to make room for new incoming data. An in-app alert notifies you when storage limits are reached, so you can review consumption and adjust data collection as needed. Contact your F5 account team to increase data storage.

Disconnected mode helper tool

For disconnected workflows, you can use the helper app documented here:

Appendix: Licensing communication examples

The following examples are synthetic decoded JSON Web Token (JWT) samples based on the structure of real licensing traffic. Values are illustrative only.

Connected and disconnected data exchange

  1. Outbound from device to licensing service: license report JWT.
  2. Inbound from licensing service to device: signed entitlement manifest JWT.

Synthetic example: Decoded license report JWT (outbound)

This example represents the decoded JWT from a local license-report-YYYY-MM-DD.json file sent for validation.

{
  "header": {
    "alg": "HS256",
    "typ": "JWT"
  },
  "payload": {
    "payload": {
      "documentType": "F5Insight Telemetry",
      "documentVersion": "1",
      "reportType": "initialize",
      "reportName": "f5insight-init-<synthetic-report-id>",
      "digitalAssetId": "<synthetic-asset-id>",
      "digitalAssetName": "f5insight",
      "digitalAssetVersion": "1.0.0-<build>",
      "customerProvidedId": "",
      "observationStartTime": "2026-03-09T23:28:18Z",
      "observationEndTime": "2026-03-09T23:29:18Z",
      "telemetryRecords": [
        {
          "metricName": "insight_aidf_allowance",
          "modeValue": 1
        }
      ]
    }
  }
}

Synthetic example: Decoded signed entitlement manifest JWT (inbound)

This example represents the decoded JWT from a returned license-manifest-YYYY-MM-DD.json file uploaded back to the device.

{
  "header": {
    "alg": "RS512",
    "kid": "v1",
    "jku": "https://product.apis.f5.com/ee/v1/keys/jwks"
  },
  "payload": {
    "documentType": "F5Insight Telemetry",
    "documentVersion": "1",
    "reportType": "initialize",
    "reportName": "f5insight-init-<synthetic-report-id>",
    "digitalAssetId": "<synthetic-asset-id>",
    "telemetryRecords": [
      {
        "metricName": "insight_aidf_allowance",
        "modeValue": 1
      }
    ],
    "entitlement": {
      "compliance": {
        "digitalAssetComplianceStatus": "valid",
        "entitlementCheckStatus": "valid",
        "telemetryStatus": "valid"
      },
      "entitledFeatures": [
        {
          "featureFlag": "insight_data_storage_gb",
          "featurePermitted": 5000,
          "featureValueType": "integral"
        },
        {
          "featureFlag": "insight_aidf_allowance",
          "featurePermitted": 1,
          "featureValueType": "boolean"
        }
      ],
      "entitlementMetadata": {
        "entitlementExpiryDate": "2027-01-30T00:21:21Z",
        "telemetryFrequency": 10080
      }
    }
  }
}