topic Re: R80.40 without SecureXL license in General Topics

R80.40 without SecureXL license

HeikoAnkenbrand — Thu, 05 Mar 2020 09:54:16 GMT

The Check Point gateways and SMS has been migrated from R60 in recent years:-) When changing from R65 to R70 the license of SecureXL was not included.

Now my question:

Will I have problems if I use R80.40 without a SecureXL license?

Unfortunately I can't test this either, because I cannot build an Eval license without the SecureXL license part.

Re: R80.40 without SecureXL license

Tal_Paz-Fridman — Thu, 05 Mar 2020 10:03:49 GMT

The license to SecureXL is part of the ADNC Software Blade that also includes Advanced Routing, Clustering, QoS and more.

When you break the macro for CPSB-ADNC it contains the following:

::CPSB-ACCL
::CPSB-SWB
fw1:6.0:swb (primitive)
::CPMP-CXLS-U-NGX
fw1:6.0:cluster-1 (primitive)
::CPVP-CPLS-1-NGX
fw1:6.0:cpls (primitive)
::CPMP-CXL-HA-U-NGX
fw1:6.0:cluster-u (primitive)
::CPMP-PPK-1-NGX
::CPMP-MPU-1-NGX
fw1:6.0:mpu (primitive)
::CPVP-SXL-1-NGX
fw1:6.0:sxl_vpn (primitive)
::CPFW-SXL-1-NGX
fw1:6.0:sxl_fw (primitive)
fw1:6.0:sxl_ppk (primitive)
::CPSB-ADN
::CPSB-SWB
fw1:6.0:swb (primitive)
::CPFW-CC-U-NGX
fw1:6.0:connect (primitive)
::CPTC-FGM-U-NGX
etm:6.0:fgmodunl
etm:6.0:fgunl
fw1:6.0:pam (primitive)
etm:6.0:fgcountunl (primitive)
etm:6.0:fg (primitive)
etm:6.0:fgmodbase
etm:6.0:tclog (primitive)
etm:6.0:fgvpn (primitive)

Re: R80.40 without SecureXL license

HeikoAnkenbrand — Thu, 05 Mar 2020 13:10:11 GMT

Hi @Tal_Paz-Fridman,

this is the problem.

The customer has not an ADNC license. He still has the old R65 ADN license (change from R65 to R70). The old license does not contain ACCL, which included the activation of SecureXL.

New license since R70:
ADNC = ADN + ACCL

Old license befor R70:
ADN > ClusterXL HA, dynamic routing, multicast support <<<< The customer has this license
ACCL > SecureXL , ClusterXL LS, advanced networking, advanced routing, multicast , QOS, ISP redundancy, load balancing

Questions:

1) Can he use SecureXL with the ADN license in R80.30 vs. R80.40?

2) Are there problems with R80.30 vs. R80.40 when ACCL is missing?

Re: R80.40 without SecureXL license

G_W_Albrecht — Thu, 05 Mar 2020 13:20:31 GMT

Besides these questions that will make us gain more knowledge: Why not use a contemporary license ? The change from a license with ADN to one with ADNC should be easily done, if needed with the help of the local SE?

Re: R80.40 without SecureXL license

HeikoAnkenbrand — Thu, 05 Mar 2020 15:11:45 GMT

Hi @G_W_Albrecht,

But costs money.

As far as I know, you could do this only 1 year after the change from R65 to R70 for free. That's about 14 years too late 🙂

With R80.20 the ADN license works without problems. I'm only worried with R80.30+, as there have been many changes to CoreXL and SecureXL. You can read more here in my article: R80.x - Security Gateway Architecture (Logical Packet Flow)

>>> The question is, does R80.30/ R80.40 work with disabled SecureXL (fwaccel off) and a ADN license? <<<

Re: R80.40 without SecureXL license

G_W_Albrecht — Thu, 05 Mar 2020 14:59:00 GMT

Yiou are talking about the change from R65 to Blade licensing ! If the customer is still using R70, all will work (except updates, of course) with the legacy licenses - but i can not image that the customers has payed support for 14 years without changing to blade licensing !

I suggest just to ask the local SE...

Re: R80.40 without SecureXL license

Tal_Paz-Fridman — Thu, 05 Mar 2020 15:09:52 GMT

Could be. If the old license he has is :CPFW-SXL-1-NGX then it contains the 2 relevant licenses for SecureXL:

fw1:6.0:sxl_fw (primitive)
fw1:6.0:sxl_ppk (primitive)

I suggest he contacts Account Services.

Re: R80.40 without SecureXL license

HeikoAnkenbrand — Thu, 05 Mar 2020 15:15:44 GMT

Hi @Tal_Paz-Fridman ,

Thanks!

I think we should change the license to ADNC.