topic Re: ElasticXL Licensing? in Firewall and Security Management

ElasticXL Licensing?

Bob_Zimmerman — Thu, 02 Jan 2025 15:08:35 GMT

In the R82 Scalable Platforms Administration Guide's section on ElasticXL, the licensing section (Installing licenses on ElasticXL Cluster Members) has an instruction which confuses me a bit:

In Check Point User Center, generate a license for each appliance using these parameters:

IPv4 address of the ElasticXL Cluster. This is the IPv4 address of the "Mgmt" interface of the first appliance, on which you ran the Gaia First Time Configuration Wizard.
MAC Address of the "magg1" interface of each appliance.

I don't see anywhere in the User Center to use the MAC address when generating a license. Is this just saying to generate a local license for each member to the same IP (magg1)? Or is there some new process to generate the licenses which I'm missing?

Re: ElasticXL Licensing?

the_rock — Thu, 02 Jan 2025 17:59:10 GMT

Thats what it sounds like to me, local license on each member for same IP. but I would double check with Account services, to be sure.

Andy

Re: ElasticXL Licensing?

PhoneBoy — Thu, 02 Jan 2025 19:15:01 GMT

That's the way I interpret it, but agree it's a bit confusing since the only time I've seen a license generated with a MAC was with a "permanent" license.

Re: ElasticXL Licensing?

David_Robinson — Thu, 02 Jan 2025 22:50:39 GMT

Each node needs its own local license using the same IP and installed using the cplic put command.

Re: ElasticXL Licensing?

HeikoAnkenbrand — Fri, 03 Jan 2025 14:09:46 GMT

Each gateway requires a local license.
You should always use the Sync IP address for the locale license:
GW1_1    192.0.2.1
GW1_2    192.0.2.2
GW1_3    192.0.2.3

The MAC address corresponds to the physical appliance.

Afterwards, the license must be installed on each ElasticXL gateway using the “cplic” command:

expert
m 1_1
expert
cplic put -l license-file-GW1_1.lic
m 1_2
expert
cplic put -l license-file-GW1_2.lic
...

Re: ElasticXL Licensing?

Bob_Zimmerman — Fri, 03 Jan 2025 14:33:38 GMT

Wait, so both of the "parameters" described in the documentation are wrong?

I get that they have to be local licenses. The management can only stick central licenses on systems it's aware of, and part of how ElasticXL operates involves the management not being aware of all of the members of the cluster, therefore central licenses aren't an option. That makes sense.

Re: ElasticXL Licensing?

David_Robinson — Fri, 03 Jan 2025 14:39:35 GMT

I didn't use the Sync interface address I used the Management address (which is the same IP for all nodes) and installed using cplic put command on each node

Re: ElasticXL Licensing?

Eric_D — Fri, 17 Jan 2025 20:41:05 GMT

The reason one might choose Sync interface IP addresses versus Management IP is in the case the management IP address might get changed in your environment, thus requiring the licensing to change. The ElasticXL Sync IP addresses will not change and are defined by the ElasticXL initial configuration and new gateway onboarding.