topic Re: vesc_lic_cli auto renewal? in Cloud Firewall

vesc_lic_cli auto renewal?

LazarusG — Thu, 21 Sep 2023 10:49:33 GMT

In the case where cloudguard clusters have central CPSG-VE+X licenses distributed via the vsec_lic_cli tool on the management server; do you know what happens when the license expires and is renewed?

Does the mgmt server acquire the new license from UC and distribute it accordingly?

Or do we need to manually apply the new license?

I don't think it's described in the documentation (other than the initial manual license application);

https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Central_License_Tool_Admin_Guide/Content/Topics-Central-License-Tool/Managing-Central-Licenses.htm

I imagine that if its a new license we will need to walk through this process again.

Or will the existing license simply have the contracts/subscriptions updated on UC and acquired by the mgmt server?

Many Thanks

Re: vesc_lic_cli auto renewal?

Bryan-Smith — Thu, 21 Sep 2023 14:37:25 GMT

@LazarusG

Best Practice - We recommend that the single Management Server and the Multi-Domain Server (when you work in Domain mode) have connectivity to the Internet. Internet connectivity lets the tool to automatically import the contracts of the licenses from the User Center. If you do not have Internet connectivity, then you must import the blade contracts manually.

https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Central_License_Tool_Admin_Guide/Content/Topics-Central-License-Tool/Overview.htm?tocpath=Overview%7C_____0#Overview

Re: vesc_lic_cli auto renewal?

LazarusG — Thu, 21 Sep 2023 16:05:37 GMT

Thanks, much appreciated. Ill feedback on outcome.

Re: vesc_lic_cli auto renewal?

the_rock — Thu, 21 Sep 2023 17:02:43 GMT

What @Bryan-Smith gave you is definitely true. I also confirmed the same with license folks this morning.

Andy

Re: vesc_lic_cli auto renewal?

LazarusG — Wed, 04 Oct 2023 16:05:02 GMT

Hi - well the renewal was processed but on a new CK - vsec_lic_cli did indeed know about the new CK without our intervention, but it didn't distribute it to the 16 AWS gateways, they stayed subscribed to the expired one. We just chose the option to change the default pool and it seems to have worked. However If I hadn't put the 16 VE evals on then there would have been a problem. So my personal experience is that it's automated upto a point (unless I have missed a step).

Also I wonder if they had put the licenses in a new UC (Like sometimes seems to happen) if it would have failed and needed the manual process to add the license (?) Thanks!