topic Re: vsec_central_license issue - error in line x in Cloud Firewall

vsec_central_license issue - error in line x

Alex_Fray — Thu, 19 Jul 2018 08:27:00 GMT

We have a Checkpoint Deployment consisting of:

1 x Checkpoint manager on-premise running R80.10

4 x Checkpoint VSec in Azure running R77.30 (clusters)

8 x Checkpoint VSec in Azure running R80.10 (mix of clusters and single gateways)

24 x VSec Core licenses. We've bought these over time so have 3 licenses (4, 8 and 12 core). All of which get allocated to each VSec gateway.

I'm in the process of migrating the VSec clusters running R77.30 to single gateways running R80.10. Moving away from clusters in Azure because the HA is, to be polite, not great.

When licensing the new gateways using the vsec_central_license command on the manager I am now getting errors "error in line x". issuing licenses via vsec_central_license utility was working fine and only recently started doing this as I've been removing and creating new VSec gateways.

[Expert@manager]# vsec_central_license

Getting licenses from all modules ...

Dev_VSec - attaching licenses...

Error in line: 2

Test_VSec - attaching licenses...

Error in line: 2

Prod_VSec - attaching licenses...

Error in line: 2

And so on...

Looking in Smart Update, its all a bit of a mess now with duplicate licenses on the nodes, some with contracts, some without. This is not a happy state to be in. I've raised a support call but this is not progressing quick enough so interested to see if others have had the same issue and resolved it?

Re: vsec_central_license issue - error in line x

Guy_Schreiber — Thu, 19 Jul 2018 11:27:19 GMT

Proxying for RND
"This is probably an issue that was fixed in R80.10 jumbo. The customer just need to install jumbo and the problem will be solved."

Re: vsec_central_license issue - error in line x

Alex_Fray — Fri, 27 Jul 2018 07:36:13 GMT

I'm running R80.10 HFA70 on the manager, i can't see any issues resolved up to take 112 regarding licensing in the HFA release notes.

I resolved the issue by following sk118672 (to certain a extent as this SK is specific to NSX not Azure which is my use case). It appears duplicate vsec license entries were on the manager and had to be deleted from guidbedit. These were easily identified as they had the same string.

1. detached the 4-core vsec licenses from every node in smartupdate

2. Some licenses still showed as attached to the vsec gateways in smartupdate, if you try to delete again it will error

3. Deleted all the 4-core vsec license entries from guidbedit

4. Re-download the 4-core vsec license from Checkpoint usercenter

5. Upload to smart update

6. ran vsec_central_license

Note. I only got an error on a single line instead of two lines, so looks like it has worked but I still have an issue with my 8-core license which also had duplicates in guidbedit.

7. repeat steps 1 to 5 for the ve-8 core license then ran vsec_central_license command again.

Note. No errors when running vsec_central_license command.

Not impressed with how the vsec gateways are licensed. Why is checkpoint licensing such a pain in comparison with Palo Alto Networks

Re: vsec_central_license issue - error in line x

Guy_Schreiber — Sun, 29 Jul 2018 09:52:24 GMT

This issue was fixed in Jumbo hot fix package 94 according to RND