Palo Alto: What Is Licensed, What Is Not

There seems to be some confusion around what you need a license for on the Palo Alto and what you don't need a license for.  I thought I would put some things down I had from my own notes.

App-ID: free with the purchase of the Palo unit.
VPN global protect client: no licensing required for global protect client.  There are some connection limitations based on the model of the unit.

URL filtering: requires a license.
Wildfire:  With subscription, it takes about 15 minutes to get an update for infected file types  Customers without Wildfire subscription get the fix in the next day update.
Threat Prevention: (IPS, Spyware, AV)  requires a license.
For VPN - Posture assessment (hip check) is a "paid for" solution.  Mobile client is a "paid for" solution.  This is called "global protect gateway".