topic Re: Licence Entitlement in Firewall and Security Management

Licence Entitlement

m_k_user — Tue, 12 Dec 2023 13:47:51 GMT

Hi Check Point team and community
Please, give me a clarification.
We have Check Point Security Gateway (Version: R81.10 Jumbo Hotfix Take 110), it is provided in the GCP. "cplic print" shows all licenses/blades are actual, but Maintenance->License Status show almost all licenses as "Available", and just few "Entitled". For example, "show security-gateway ips status" output is "IPS Blade is disabled".
Should the blades be activated somehow?
Or should the lacking blades be purchased via GCP market?
Maybe there was a licensing failure?

Re: Licence Entitlement

Chris_Atkinson — Tue, 12 Dec 2023 15:27:17 GMT

Could you please attach the output of the cplic print for review. Also what blades are activated in the corresponding gateway object settings in SmartConsole?

Re: Licence Entitlement

the_rock — Tue, 12 Dec 2023 15:26:34 GMT

I think if you call Account services, they can sort this out quickly. But as @Chris_Atkinson said, if you send cplic print -x output, we might be able to confirm.

Andy

Re: Licence Entitlement

m_k_user — Wed, 13 Dec 2023 07:29:53 GMT

So, here are output and licenses from Smart Console.
And, sorry, I am frustrated with finding the blades switch on/off. Seems realy different from SMB hardware. They are in the Access Policy/ Rules, aren't they?

Re: Licence Entitlement

Chris_Atkinson — Wed, 13 Dec 2023 09:52:44 GMT

The outputs suggest only the basic FW function has been activated.

For ease you can confirm this from the gateway cli by executing "enabled_blades"

The Threat Prevention admin guide for your version will provide further guidance on subsequent blade activation.

Re: Licence Entitlement

the_rock — Wed, 13 Dec 2023 10:21:16 GMT

Blades are turned off by using smart console fw object, unless you have one of those locally managed smb appliances, then you can do it through web UI.

As Chris said, based on the output, appears only fw blade is active. Honestly, just save yourself frustration, call Account services, give them your account number, explain the issue and Im positive they will be able to help you quick. If Im not mistaken, they are open M-F 7 am to 7 pm CST. (GMT-6)

Andy

Re: Licence Entitlement

m_k_user — Wed, 13 Dec 2023 10:44:34 GMT

I know that Blades are not active - confirmation is excess.
As I understand I should create policy containing the required blades in the section "Threat Prevention" and then Install this policy (to the gateways). Right?

Re: Licence Entitlement

G_W_Albrecht — Wed, 13 Dec 2023 11:00:02 GMT

You can enable/disable TP blades in GW object and then publish the changes - policy changes are transmitted by policy install...