VSEC Licensing Allocation

Amit_Singh4 — Tue, 28 Jan 2020 08:24:00 GMT

CMA version - R80.30, Gateway Version – R80.10

One CMA having two different clusters.

Each Cluster having two gateways in Active Standby mode and each gateway is having four cores enabled.

I have 4 core licenses.

My Question is – While assigning license, do we need to consider only Active gateway or must be considered standby gateway also?

Active gateway can be mapped with 4 cores license but if we need to consider standby unit then it will need 8 cores license, OR 4 core License will be applicable to both Active & Standby. Could you please confirm about it.

Reference:-

[Expert@ fw-01b:0]# cphaprob stat

Cluster Mode: High Availability (Active Up) with IGMP Membership

Number Unique Address Assigned Load State

1 X.X.X.1 0% Standby

2 (local) X.X.X.2 100% Active

[Expert@fw-01a:0]# cphaprob stat

Cluster Mode: High Availability (Active Up) with IGMP Membership

Number Unique Address Assigned Load State

1 (local) X.X.X.1 0% Standby

2 X.X.X.2 100% Active

My question is which below output needs to be considered while assigning license.

fw ctl multik stat & fw ctl affinity -l -r both commands having different results.

Fw ctl multik results showing number of corexl enabled on gateways and because of that it is showing only 3 cores whereas ctl affinity command showing number of cores enabled on gateway.

[Expert@fw-01a:0]# fw ctl multik stat

ID | Active | CPU | Connections | Peak

----------------------------------------------

0 | Yes | 3 | 7 | 39

1 | Yes | 2 | 3 | 36

2 | Yes | 1 | 2 | 35

[Expert@ fw-01a:0]# fw ctl affinity -l -r
CPU 0: eth0 eth1 eth2 eth3 eth5
CPU 1: fw_2
mpdaemon vpnd in.asessiond fwd cprid cpd
CPU 2: fw_1
mpdaemon vpnd in.asessiond fwd cprid cpd
CPU 3: fw_0
mpdaemon vpnd in.asessiond fwd cprid cpd

Re: VSEC Licensing Allocation

mdjmcnally — Tue, 28 Jan 2020 11:27:18 GMT

To meet the licensing requirements then for an Active/Standby Cluster with 4 Cores in each then you should have 8 Core of Licensing availble.

What I have found in previous installs is that the licensing tool will actually install a copy of the license from the pool so would install a 4 Core License to each gateway. However have been told that is now actually fixed.

As there are 4 CPU Cores then would need 4 Cores. Doesn't matter how they are split, ie 1 SND and 3 CoreXL or 2 SND and 2 CoreXL, would still require 4 Cores.

vsec_lic_cli is a newer license tool as opposed to the vsec_central_license, however haven't checked that out yet.

You should however still have 8 Cores to be licensed properly

Re: VSEC Licensing Allocation

Amit_Singh4 — Tue, 28 Jan 2020 12:16:27 GMT

@ mdjmcnally, Thank You for inputs. Much appreciated.

topic VSEC Licensing Allocation in Cloud Firewall

VSEC Licensing Allocation

Re: VSEC Licensing Allocation

Re: VSEC Licensing Allocation