topic Re: Licensing Question in Endpoint

Licensing Question

NeilDavey — Tue, 16 May 2023 06:40:00 GMT

Good Morning

I am migrating away from the Mobile Access VPN to a client based VPN and have a question around the licenses that I have.

In my portal, I have these = CPSB-MOB-200-HA

Looking at this document, these are Mobile Access Licenses and could be used for Check Point Mobile for Windows as well.

https://support.checkpoint.com/results/sk/sk84560

From the support Center, I have downloaded the package E87.30 Check Point remote Access VPN Clients for Windows (E87.30_CheckPointVPN.msi) and during the install, I select Check Point Mobile. Create the site and connect ok.

On connecting to the VPN, in SmartView Monitor it says I am connected as Client Type Endpoint Connect. Is this correct for the licenses that I have already?

What I don't want to happen, is to migrate my users to this new VPN and then be hit with a connection limit as I do not have the correct licenses.

Thanks for your help here.

Re: Licensing Question

G_W_Albrecht — Tue, 16 May 2023 07:25:51 GMT

There should be no issue as licensing is valid. CPSB-MOB-200-HA is HA Cluster node license, so the other node should have a CPSB-MOB-200 installed.

Re: Licensing Question

Chris_Atkinson — Tue, 16 May 2023 10:38:09 GMT

@G_W_Albrecht is correct.

Refer "Check Point Mobile for Windows" here:

sk67820: Check Point Remote Access Solutions - Gateway-Based Access

Re: Licensing Question

the_rock — Tue, 16 May 2023 10:39:16 GMT

You would have no issues.

Re: Licensing Question

NeilDavey — Tue, 16 May 2023 12:32:20 GMT

Thank you. I will progress with the version I have downloaded as the correct one then.

Re: Licensing Question

G_W_Albrecht — Tue, 16 May 2023 12:58:32 GMT

I talked to sales and heard that licenses for Endpoint Security VPN with Desktop Firewall configured in Dashboard are not available anymore - current users can renew the licenses, but new users have to buy a Harmony EP package. Clearly, Desktop Firewall is Legacy, Harmony EP is much better security 8)

Re: Licensing Question

NeilDavey — Tue, 16 May 2023 13:16:11 GMT

What does this mean for my licenses then?

CPSB-MOB-200-HA

Will I come across any issue?

I have not setup the Destkop Firewall policy.

This is the rule we allow for access

Re: Licensing Question

G_W_Albrecht — Tue, 16 May 2023 13:22:59 GMT

No, if you select Check Point Mobile for install, all is well licensed ! If you need a Desktop Firewall you have to buy Harmony.

Re: Licensing Question

NeilDavey — Tue, 16 May 2023 13:37:39 GMT

Thanks for the confirmation here.

Re: Licensing Question

the_rock — Tue, 16 May 2023 13:56:13 GMT

@NeilDavey I said this I cant even count how many times before...if I lived 1000 years, I would NEVER understand CP licensing, I really mean that. What I always do, if in doubt, I just "slap" eval license, which covers everything and dont think about it for 30 days : - )

Andy

Re: Licensing Question

NeilDavey — Tue, 16 May 2023 14:00:07 GMT

Thats a good solution. It is rather confusing.

From what G_W_Albrecht has confirmed, I am all ok with the install and my current licenses. On this basis, I will progress with my roll out.

This seems a better solution anyhow as the MAB requires JAVA and also we get issues with Admin Prompts needed for our users which is annoying and causes us issues.

Re: Licensing Question

the_rock — Tue, 16 May 2023 14:01:54 GMT

Well, @G_W_Albrecht is a CP legend after all, he knows his stuff! But yes, based on all that was discussed, Im fairly confident it would work.

Andy

Re: Licensing Question

G_W_Albrecht — Tue, 16 May 2023 15:12:33 GMT

It is a viable solution if the users have other EPS on their laptops, but for mobile phones and tablets, MAB is just fine. Also MAB provides pure clientless access to applications deployed on the internal network, see sk104577: ATRG: Mobile Access Blade

The confusing part is the Legacy CP VPN client (i can date it to 2010 or before) 8) that has later been the little brother of EPS client. So you have one installer, but the three selectable flavours have different licensing:

- SecuRemote (no Office Mode!) does need no license, only IPSec VPN blade

- Check Point Mobile (Office Mode + SCV) uses the concurrent MAB license

- Endpoint Security VPN (Office Mode + SCV + Desktop Firewall) uses per seat licenses (same as EPS client)

Reason for this is just evolution 😉

Re: Licensing Question

G_W_Albrecht — Tue, 16 May 2023 15:37:08 GMT

I must admit that CP licensing can sometimes be confusing, mostly in phases of new licensing methods introduction (Blade licensing and VPN client!). But just ask me, i can help sometimes...

Re: Licensing Question

the_rock — Tue, 16 May 2023 16:07:30 GMT

You always help Guenther 💪...to say CP licensing can be confusing is a true understatement lol. Anyway, lets leave that subject alone 🤣

Re: Licensing Question

the_rock — Thu, 18 May 2023 16:58:35 GMT

Eval license is your best friend...you will never have any issues with it, guaranteed! 🙂