topic Re: Checkpoint licensing R80.30 in General Topics

Checkpoint licensing R80.30

jijotms0511 — Wed, 02 Dec 2020 02:48:09 GMT

Hi All,

Got a checkpoint device 3600 model with R80.30. It is configured as a standalone device. No HA.

Which is the best mode of licensing in the standalone mode ( local licensing or central)?

Also, we are planning not to use the Mgmt port IP for the licensing and have made one subinterface like eth2.XXXX vlan in the checkpoint as the management IP, which is connected down to the switch. Currently this interface is set as Mgmt interface in the checkpoint. Can we use this subinterface IP for licensing ?

Thanks,

Re: Checkpoint licensing R80.30

PhoneBoy — Wed, 02 Dec 2020 06:22:02 GMT

Central licensing means "licenses are pushed from management."
Since the gateway and the management are the same on a standalone gateway, a local license is best.

I believe you can license against a VLAN IP, but I haven't tried it myself.
You can use any IP that's associated with a physical interface.

Re: Checkpoint licensing R80.30

jijotms0511 — Wed, 02 Dec 2020 07:36:48 GMT

Thank you so much for the Info!

Re: Checkpoint licensing R80.30

jijotms0511 — Wed, 02 Dec 2020 09:37:52 GMT

Hi, One more question on the same. It was identified that , when Checkpoint was connected to the internet for testing after initial config for patch update etc, as per the new feature of checkpoint , the license was automatically updated. At the point of connecting to the cloud the Mgmt Port say was configured like 1.1.1.1 , and it was taken as the License IP ( for generating the same).

But actually we need to use another interface as the management port like ( eth 2.XXXX) vlan interface and say like ip tagged to it is 2.2.2.2

Currently as the IP address cannot be changed as the IP address is already tagged with the license, will there be an issue, if we make the "set an Management" option to make ( eth 2.XXXX) vlan interface and say like ip tagged to it is 2.2.2.2 as the management interface and planning not to connect the Mgmt port. But we will retain the IP for Mgmt as 1.1.1.1 itself?

In this case , so just wanted to confirm when the device is connected to Internet , any issues with the licensing ?

Thanks,

Re: Checkpoint licensing R80.30

Maarten_Sjouw — Wed, 02 Dec 2020 13:50:11 GMT

As long as the IP of the license is on the gateway it should work, set the interface as the management interface. You can change the IP in the usercenter later.

Re: Checkpoint licensing R80.30

_Val_ — Wed, 02 Dec 2020 14:15:44 GMT

You can set up a license to any IP address belonging to your asset. Also, you can change the original IP address with your license in the UserCenter, at least once.

Re: Checkpoint licensing R80.30

jijotms0511 — Wed, 02 Dec 2020 15:23:18 GMT

Hi , when we change the IP address in usercenter , do we need to regenerate the license file again or just go to usercenter and update the IP address . Also at Gaia make the new ip set as mgmt?Is My understanding correct ?

Re: Checkpoint licensing R80.30

_Val_ — Wed, 02 Dec 2020 15:27:33 GMT

You need to generate a new one, remove the old one and replace. Just re-generating on UC is not enough

Re: Checkpoint licensing R80.30

jijotms0511 — Wed, 02 Dec 2020 15:34:15 GMT

Noted thanks