topic Re: ESXi virtual firewall instance in Cloud Firewall

ESXi virtual firewall instance

Glenmark_Impex — Mon, 20 Mar 2023 11:22:54 GMT

Hello all experts!

We would like to use Checkpoint gateway virtual (ESXi VM) instance instead "hardware" openserver solution or appliance. My question is what a kind of a license we should buy?
CPSG-XC-NGTP or CPSG-VSEC-VEN-BUN.

Re: ESXi virtual firewall instance

G_W_Albrecht — Mon, 20 Mar 2023 11:33:04 GMT

CPSG-VSEC-VEN-BUN-NGxx-... = 1 CloudGuard Network virtual core for VMware ESXi, Hyper-V, KVM Gateway.

Re: ESXi virtual firewall instance

Chris_Atkinson — Mon, 20 Mar 2023 12:24:53 GMT

Both will work but the VSEC SKU is the better option.

Re: ESXi virtual firewall instance

Glenmark_Impex — Mon, 20 Mar 2023 13:03:33 GMT

Dear Chris

If openserver "CPSG-XC-NGTP license + ESXi vm" supported by Checkpoint in this case cost of ownership will much more better.
But for example: we will open TAC request in the future. Do we have any risk get back answer - your license officially incompatible with virtual solution?

Re: ESXi virtual firewall instance

Chris_Atkinson — Mon, 20 Mar 2023 13:21:39 GMT

Wouldn't think so but suggest discussing in detail with your CP SE as the scope of detail provided here around use case is pretty limited.

Re: ESXi virtual firewall instance

G_W_Albrecht — Mon, 20 Mar 2023 15:02:27 GMT

Any CPSG-xC-NGTP will cost more as CPSG-VSEC-VEN-BUN-NGTP, especially after 1 year. Also, Management license is included in CPSG-VSEC-VEN-BUN, but not in CPSG-xC-NGTP.

Re: ESXi virtual firewall instance

G_W_Albrecht — Mon, 20 Mar 2023 15:55:08 GMT

You will get a warning on every reboot that you do not have the appropriate license for ESXi - but no further adoo anyway. This is more a hint that Cost is lower with VSEC-VEN 8)

OpenServer licenses are expensive compared with alternatives - sales reports they are seldom sold, mostly renewed...

Re: ESXi virtual firewall instance

Glenmark_Impex — Fri, 07 Apr 2023 13:32:15 GMT

Dear Albrecht,

Thank you for advice.

Just for clarification, we have answer from Checkpoint sales, Management blades should be purchased separately. May be they have some differences in an offers for different regions.

Re: ESXi virtual firewall instance

PhoneBoy — Sat, 08 Apr 2023 02:53:37 GMT

I cannot check at the moment if the SKU you mention includes local management or not.
In general, any gateway SKU that includes a management component can only run management on the same system as the gateway.
Meaning: if you want to run management on a separate system from your gateway, you need to purchase a separate license for it.

Hope that clarifies things.