topic Re: SD-WAN licensing in SD-WAN

SD-WAN licensing

MikeB — Thu, 26 Oct 2023 20:36:28 GMT

Hi Checkmates,

According to all quantum appliances datasheets, we can add SD-WAN as "optional" feature with NGFW subscription services

but, licensing Instructions for SD-WAN in Product Catalog webpage indicates AppControl blade and URL Filtering blade are required in order to activate SD-WAN.

This creates a conflict since URL Filtering is not included with NGFW, so it would be mandatory to have NGTP or SNBT for SD-WAN to work??

Re: SD-WAN licensing

the_rock — Thu, 26 Oct 2023 20:50:14 GMT

I would definitely verify this with Account services.

Andy

Re: SD-WAN licensing

PhoneBoy — Thu, 26 Oct 2023 21:08:20 GMT

It's not strictly required.
However, steering traffic based on applications requires NGTP/SNBT.

Re: SD-WAN licensing

MikeB — Sat, 28 Oct 2023 14:30:52 GMT

thank you for your answer @PhoneBoy , but why would it be necessary if you already have App Control with NGFW?? This little detail makes licensing unnecessarily complex and expense. If SD-WAN is optional for NGFW, it should include "all" of its functionalities and use cases, otherwise, it should not be offered for NGFW.

Re: SD-WAN licensing

Shlomi_Feldman — Sun, 29 Oct 2023 14:35:31 GMT

Hi Mike,

if the steering is made by services then you can have SDWAN on top of NGFW

if the steering is made by applications, then you need to have both Application Control and URL Filtering. in this case and as URLF is not part of NGFW, then you need to have SDWAN on top of NGTP or SNBT

Re: SD-WAN licensing

MikeB — Mon, 30 Oct 2023 00:05:53 GMT

thanks for the clarification. It is clear to me that for SD-WAN to fully work, NGTP or SNBT is required.
It would be very interesting if Check Point could consider including URL Filtering along with the SD-WAN blade when you have NGFW, this way you could have a much more competitive offer and designed to cover other scenarios (for example when the customer already has a non check point perimeter security solution and is only interested in SD-WAN).