App-ID: free with the purchase of the Palo unit.
VPN global protect client: no licensing required for global protect client. There are some connection limitations based on the model of the unit.
Wildfire: With subscription, it takes about 15 minutes to get an update for infected file types Customers without Wildfire subscription get the fix in the next day update.
Threat Prevention: (IPS, Spyware, AV) requires a license.
For VPN - Posture assessment (hip check) is a "paid for" solution. Mobile client is a "paid for" solution. This is called "global protect gateway".