topic Re: Inject license failed, on some blade security gateway in Firewall and Security Management

Inject license failed, on some blade security gateway

Adity12 — Fri, 15 Apr 2022 14:44:59 GMT

Hi All,

Have a good day,

My customer has a problem with the license security gateway update.

When they inject that license with smart updates, some blades are updated for up to a year but there are two blades: anti-bot and anti-virus.

The blade does not use the new license but still uses the old license.

I was also to try to inject again but the problem still appears.

In my lab I also had the same problem with my customer but I solved this problem by manually injecting the gateway.

i use cplic put command, but for this command should i reboot the gateway or not? if i reboot the gateway will update for new license.

the following is attachment for capture result of injection license.

Thanks Regards

Dio Aditya Pradana

Re: Inject license failed, on some blade security gateway

the_rock — Fri, 15 Apr 2022 14:55:56 GMT

You only need to do the reboot if it says number of cores had changed, otherwise, no.

Andy

Re: Inject license failed, on some blade security gateway

Adity12 — Fri, 15 Apr 2022 14:59:12 GMT

@the_rock nice answer

does you know, what root of this issue? or maybe gateway can't use that license on some blade or there is another issue.

Like bug maybe. CMIIW

Thanks Regards

Dio Aditya P

Re: Inject license failed, on some blade security gateway

the_rock — Fri, 15 Apr 2022 15:01:43 GMT

If the actual license covers those blades, then remove any trial licences.

Re: Inject license failed, on some blade security gateway

Tal_Paz-Fridman — Sat, 16 Apr 2022 13:44:35 GMT

Can you share the output of cpstat os -f licensing from the Security Gateway?

Thanks

Re: Inject license failed, on some blade security gateway

Adity12 — Sat, 16 Apr 2022 14:12:03 GMT

Hi @Tal_Paz-Fridman

Thanks for your suggestion, i will check it first.

Thanks Regards

Dio Aditya P

Re: Inject license failed, on some blade security gateway

G_W_Albrecht — Sat, 16 Apr 2022 15:24:45 GMT

Also check cplic print to see if another AV / AB license is active still ! And look if you also can see the correct service date on the new license.

Re: Inject license failed, on some blade security gateway

Adity12 — Sun, 17 Apr 2022 08:56:32 GMT

Hi @Tal_Paz-Fridman

The following attachment is result from cpstat os -f licensing from 2 gateway.

FYI: only 2 blade can't renew license.

Re: Inject license failed, on some blade security gateway

Adity12 — Sun, 17 Apr 2022 08:59:26 GMT

Hi @G_W_Albrecht

Here the result of command cplic print.

Service date has successfull use new license for all license, include AV and AB

Thanks

Re: Inject license failed, on some blade security gateway

G_W_Albrecht — Sun, 17 Apr 2022 09:51:42 GMT

Services look OK - but what about the license itself, is it only one for one appliance ?

Also found this - sk105057: Enterprise Based Protections (EBP) contract not taking effect

as you use EBP.

Re: Inject license failed, on some blade security gateway

Adity12 — Sun, 17 Apr 2022 09:49:17 GMT

Yes, each appliance has a each self license, so there is two different license for FW_1 and FW_2.

The difference is the second appliance on cluter use HA on the name license.

Re: Inject license failed, on some blade security gateway

G_W_Albrecht — Sun, 17 Apr 2022 09:55:19 GMT

You should be able to see the older license.

Re: Inject license failed, on some blade security gateway

Adity12 — Sun, 17 Apr 2022 10:02:33 GMT

Yes, I found that license has expiry day until April 26, 2022

Re: Inject license failed, on some blade security gateway

G_W_Albrecht — Sun, 17 Apr 2022 14:37:44 GMT

If you want to remove it, use cplic print -x to see the license signature you use in

cplic del axxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

to remove it. Or, just wait 8) !

Re: Inject license failed, on some blade security gateway

Adity12 — Tue, 26 Apr 2022 13:18:56 GMT

Hi All,

Thanks for your advice and support, this case has been resolved.

Yesterday i held session with my customer and checkpoint support.

Here is the summary of session, i think it will be useful for who has same issue like my customer.

Anti-Bot/Anti-Virus : About to expire (26/04/2022)
cplic print shows parament license
cpstat os -f licensing : Entitled with correct date.
Install database, no luck
contract_util mgmt no luck
try to check on database psql on management server
verify there is a old license still used by blade
delete old license from psql database
Disable the blades, pushed the policy
Enabled the blades, pushed the policy
Issue resolved

Thanks Regards

Dio Aditya Pradana

Re: Inject license failed, on some blade security gateway

the_rock — Tue, 26 Apr 2022 13:30:43 GMT

Tx for the update...just curious, when you say "

delete old license from psql database

What exactly are you referring to? Was there a file you guys had to remove?

Andy

Re: Inject license failed, on some blade security gateway

Adity12 — Tue, 26 Apr 2022 13:48:46 GMT

yes, because when we checking database on management server and use command psql_client monitoring postgres to open monitoring database and using command select * entitlement where blade_name='Anti-Virus' and entitlement status='Entitled'; and the result is there is 4 list license 2 will expire on 26 april 2022 and other will expire 26 april 2023. ( the old licensing still using)