A PA-220 with expired licenses will still work as a router and simple firewall management. You’ll be missing the Palo Alto stuff like url filtering dynamic updates and app id. You can always purchase licenses through your employer or cdw to apply. The 220 is extremely slow in commits but works pretty solid. I haven’t updated mine in over 6 months since the licenses are expired but they are stable when untouched.