topic Re: What happens if licences expire on gateway in Firewall and Security Management

What happens if licences expire on gateway

carl_t — Fri, 28 Feb 2025 15:38:32 GMT

Hi All

If our licence expires on our gateway and we are running IPS/Antibot/AV etc, what will happen?

Will it continue to run for 14 days?

Does it just stop scanning for these blades?

Will it impact any traffic, i.e stop forwarding through the gateway?

Many thanks

Re: What happens if licences expire on gateway

the_rock — Fri, 28 Feb 2025 16:32:48 GMT

Traffic wont stop, but you wont be able to push policy and blades wont get any new updates.

Andy

Re: What happens if licences expire on gateway

PhoneBoy — Fri, 28 Feb 2025 17:39:48 GMT

What you’re likely asking about is the “contract” which entitles use of annual blades.
There are specific SKs for:

IPS: https://support.checkpoint.com/results/sk/sk4417
App Control: https://support.checkpoint.com/results/sk/sk56300

In general, though:

You will see errors when pushing policy with expired contracts and/or licenses
Traffic will be passed if the access policy allows, but will not be inspected with the advanced blades that lack a current contract and is outside the grace period (if one exists).
If the base Firewall license expires (most of these licenses are perpetual), then no traffic will pass as the gateway will be enforcing “defaultFilter” which is to deny all traffic.

Re: What happens if licences expire on gateway

the_rock — Fri, 28 Feb 2025 17:48:18 GMT

I thought that traffic would NOT stop even if license expires. I recall couple times before it happened to the customer and everything sitll worked till they applied valid license the next day.

Andy

Re: What happens if licences expire on gateway

Timothy_Hall — Sun, 02 Mar 2025 05:08:15 GMT

Gateway Perpetual Blades (Firewall, IPSec VPN, Mobile Access, Identity Awareness, QoS, ClusterXL, Monitoring, DLP) have a license that never expires; the only way these features would stop working is if someone manually removed the license or it became corrupt.

All remaining blades are Subscription Blades that require a service contract present to operate. Once these features have 30 days or less left on their contracts prior to expiration, you will receive a warning every time you try to install policy to the gateway. There is no way to shut up this warning without loading a new contract.

Traditionally, Subscription Blades have had a 30-day grace period where they will keep working after expiration. However in the latest Jumbo HFAs the grace period was extended to 90 days. To my knowledge here is what will happen to the various subscription blades when they finally go beyond the 90 day grace period:

IPS - Continues enforcing Core Activations & Inspection Settings, but only enforces the "out of the box" ThreatCloud Protections. Any updated/new ones stop being enforced.

APCL - Only custom-created applications still work, no classification for any other applications (would assume they are classed as "unknown")

URLF - Only custom-created Applications/Sites still work (no categorizations for any other sites)

Content Awareness - Not sure, would assume only custom-created Data/File types would work

Anti-spam & Email Security (which no one uses) - Don't know

AV/ABOT- I would assume they stop working completely, as they are constantly dependent on the Check Point ThreatCloud to operate

Threat Emulation/Extraction & Zero Phishing - Don't know, would assume that minimally cloud-based emulation sandboxing would stop working

Re: What happens if licences expire on gateway

Timothy_Hall — Wed, 10 Sep 2025 13:48:20 GMT

It appears the grace period for license expiration is in the process of being formally documented:

sk183922: [Under Construction] Grace Period for Check Point Software Blades

Re: What happens if licences expire on gateway

rroihans — Tue, 16 Sep 2025 04:48:19 GMT

404 not found

Re: What happens if licences expire on gateway

the_rock — Tue, 16 Sep 2025 11:00:39 GMT

Is that users get when they try to connect outbound?

Andy

Re: What happens if licences expire on gateway

Tal_Paz-Fridman — Tue, 16 Sep 2025 11:11:27 GMT

I can see it is still under construction and therefore marked as Internal.

Re: What happens if licences expire on gateway

the_rock — Tue, 16 Sep 2025 11:13:01 GMT

Geesh, sorry, you meant the sk...yes, I checked it, definitely not accessible yet.

Andy

Re: What happens if licences expire on gateway

Timothy_Hall — Tue, 16 Sep 2025 11:58:01 GMT

Well, it did say "[Under Construction]", so while it was there at one point, it must be hidden now until it is completed.

Re: What happens if licences expire on gateway

PhoneBoy — Tue, 16 Sep 2025 16:59:28 GMT

You're correct 🙂

Re: What happens if licences expire on gateway

Andres14 — Tue, 30 Sep 2025 14:21:56 GMT

Hey,

do you have other info for this SK? It says not available still.

Thanks in advance,

A.V

Re: What happens if licences expire on gateway

PhoneBoy — Tue, 30 Sep 2025 15:38:54 GMT

Prior to R81, there were different grace periods for different blades.
In R81 and above with current recommended JHF, most everything has a 90 day grace period now.
That is the TL;DR of the internal SK referred to in this thread.

Exceptions:

Firewall (perpetually licensed)
VPN (perpetually licensed)
Mobile Access (perpetually licensed)
Content Awareness (perpetually licensed)
Anti-Spam / Email Security (no grace period)

If the license string has an expiration date, all bets are off, of course.
If the firewall has an expired license, the only policy that will load is DefaultFilter, which will NOT pass traffic.