topic Re: Virtual Systems package License question in Firewall and Security Management

Virtual Systems package License question

Scottc98 — Tue, 14 Mar 2023 23:44:18 GMT

Hello everyone,

Hoping someone can help me understand the differences and use cases for the Virtual System packages in the product catalog.

In general, I see two different types:

CPSB-VS-X ("X" Virtual Systems package)
CPSB-VS-X-VSLS ("X" Virtual Systems package for HA/VSLS)

For the "X", there are package options for 3, 10, 25 and 50 VSs

My question is when is each license type used?

I assume that if I want to stand up a single hardware device (Say 7000 GW for example) as a VSX gateway, I would order the first line item to meet the # of VSs required (and what fits the compute capacity).

What if you are doing a VSX cluster (2 6600 nodes for example)? Is that where the CPSB-VS-X-VSLS package is used instead? If so, is it ordered as one SKU item that is shared among the cluster (2 7000 Gws and any future ones if expanding horizontally). Or is is still one per GW regardless?

There seems to be a general MSRP price difference in the catalog as well so really trying to understand each here.

Thanks in advance

Re: Virtual Systems package License question

Chris_Atkinson — Tue, 14 Mar 2023 22:50:02 GMT

Ttraditionally (for 2016 series and earlier gateway appliances) the primary/first node of a cluster carries the non VSLS license package.

Then the -VSLS variant is only used on subsequent members of a cluster being nodes 2 or 3 etc.

Each cluster member requires it's own license.

The licenses are stackable (per-node) with exception of the smallest increment.

Re: Virtual Systems package License question

Scottc98 — Tue, 14 Mar 2023 22:56:18 GMT

Thanks @Chris_Atkinson for the response. Let me see if I understand this right:

Using a 4 node VSX cluster for 4 VSs as an example, would it be fair to say we could deploy with these two possible license situations:

Option 1:

node 1 (Primary) has a CPSB-VS-5 license and nodes 2, 3 , & 4 all each need a CPSB-VS-5-VSLS license.

Option 2:

node 1 (Primary) has a CPSB-VS-5 license and nodes 2, 3 , & 4 also have their own CPSB-VS-5 license

Option 1 licensing truly ties 3 of the members to only run in a VSLS cluster; with node 1 being able to run in a VSLS or as a single standalone VSX gateway.

Option 2 licensing provides all 4 gateways with options to be single VSX gateways or in a VSX/VSLS cluster; providing more options with the licenses in their deployment possibilities....but with a little higher cost 😉

Is that an accurate assessment or am I off?

Re: Virtual Systems package License question

Chris_Atkinson — Tue, 14 Mar 2023 23:04:10 GMT

Pretty much nailed it though I believe with the current generation hardware the VSLS SKU option is no longer relevant / presented in the product catalogue from memory. Also there isn't a 5 gateway license increment as such.

Re: Virtual Systems package License question

Scottc98 — Tue, 14 Mar 2023 23:13:17 GMT

Thank you @Chris_Atkinson . Duly noted on the lack of 5 VS package.....my failed attempt for an example breakdown. Should have just said '10' 😉

The VSLS SKU was something I was not aware of being 'legacy' but that would make sense on why the non-vsls license was recommended to us from our account team. Can't blame a customer for asking....especially when VSLS was cheaper 😉

thanks again.

Re: Virtual Systems package License question

PhoneBoy — Tue, 14 Mar 2023 23:44:10 GMT

Each gateway needs the relevant licenses.
VS licenses are used on the first member of your VSX cluster.
VSLS licenses can be used on the other members of the VSX cluster.
Note that VSLS licenses cannot be used on their own (i.e. it must be paired with a node that is using regular VS licenses).
This also means VSLS licenses cannot be used on Maestro.

VS/VSLS licenses for 10 VSes and above are stackable on a gateway (meaning, you can purchase multiple of them as needed).
VS-3 licenses are not stackable and must be traded in to a VS-10 or higher.

Re: Virtual Systems package License question

yongfu — Sun, 19 Mar 2023 17:06:31 GMT

Hi,

also to check for virtual switch/virtual routers that are not counted as VS License, will they need to be accounted for management server license ?
example for a management server of 5 gateways, with a single firewall of 10VS license, can the management server manages 5VS( with include of VS0) + 1 virtual switch? (Understand that VS0 is not counted for management license)

thank you

regards

Re: Virtual Systems package License question

Chris_Atkinson — Mon, 20 Mar 2023 12:53:37 GMT

Virtual Switches/Routers are not counted.

VSX Management licensing is outlined in sk119075.

Re: Virtual Systems package License question

Bob_Zimmerman — Mon, 20 Mar 2023 14:07:49 GMT

On older versions, routers definitely consumed a VS slot. Any idea when that changed?

Re: Virtual Systems package License question

Henrik_Noerr1 — Mon, 13 Oct 2025 14:59:37 GMT

how are other blade licenses done in regards to Virtual Systems?

Let's say I need IPS. So I need CPSB-IPS-X2L and CPSB-IPS-X2L-HA (for a large appliance)

Are all Virtual Systems licensed with IPS if I buy these for 'VS0' - or would each individual IPS enabled VS need this license.

Thanks,

Henrik

Re: Virtual Systems package License question

Chris_Atkinson — Mon, 13 Oct 2025 15:01:13 GMT

VS is covered by whichever blades the appliance is licensed for.

Re: Virtual Systems package License question

Henrik_Noerr1 — Mon, 13 Oct 2025 16:13:13 GMT

Thank you - We have been running on a EBP-NGTP free for all, so did not have to think about it.

This may continue, but I see that we pay for the privilege. Not having an EBP license hurts flexibility of course.

Appliance support can be renewed with CPSB-NGFW-XXX bundle - but links describing license features link to generic https://www.checkpoint.com/products/ page. The description is high level at: "Check Point Next Generation Firewall Gateway Blades Package (including IPS blades and Application Control)" - Or maybe it is exactly this? 🙂

That would mean adding CPSB-ADNC for normal clusterxl and securexl and CPSB-VPN for ipsec (s2s)? or are these included in CPSB-NGFW?

Maybe I am missing an obvious blade license, not sure.

Thanks

Re: Virtual Systems package License question

Chris_Atkinson — Mon, 13 Oct 2025 22:57:11 GMT

The last page of this document should help:

https://www.checkpoint.com/downloads/products/check-point-appliance-comparison-chart.pdf