topic Re: License and Support Expired Behaviors in General Topics

License and Support Expired Behaviors

spinazdoo — Thu, 11 Jul 2024 15:43:02 GMT

Hi Check Point,

I got a question, which I thought was simple but I was confused about answering it because there was no official statement in the admin guide or SK.

This morning head of CISO asked what happens if the Check Point license expires on the firewall and management side?

I found several links that show in the IPS part that the license has expired but not other features and impacts on the management and firewall itself.

Maybe I missed it, does anyone have a link or official statement about this?

Thank you 🙂

Re: License and Support Expired Behaviors

PhoneBoy — Fri, 12 Jul 2024 13:23:32 GMT

The likely reason there is not an official SK about this situation is because Firewall and Management licenses are usually sold as perpetual licenses (thus don’t expire).
They also do not have a contractual component like Application Control and Threat Prevention, which require a subscription.
The output of cplic print -x from all relevant nodes can be used to confirm your license/contract status for the various features.

If the Firewall license actually expires, the gateway will effectively “fail closed” (loading defaultFilter, which passes no traffic).
If the Management license expires, you will not be able to connect with SmartConsole or the API.
These behaviors can be easily verified by building an environment with evaluation licenses and changing the clock past the expiration date.

Re: License and Support Expired Behaviors

Lesley — Mon, 15 Jul 2024 20:35:44 GMT

I don't think there is real documentation.

I know for IPS if you enable it, run it with trial and let it expire you will get of course warnings.

After the warnings the IPS updates stop and IPS also. Only the 'core' protections will stay active. They come from the box it self (after installation of the software) They do not require license. But this is just a small part of IPS.

For app blade and URL blade I am not 100% sure I think it also depens on the fail-open, fail-closed setting in Smart Console. Also I would expect that the rules that contain application control objects will stop working.

You can buy a new firewall and it will include: 1 Year SNBT Subscription Builtin. Even if you select a 2 year service plan. So after the one year you either have to renew SNBT or go back to NGTP or NGFW.

BUT NGFW contain default IPS and application blade. So the question you ask depends on what type of blades. If it is specific IPS and application control you have to follow Phoneboy. Other blades will not be included. And what will happen depends on the blade that will expire and is enabled.

So it is a valid question and one SK that could explain this would be great. I get this question A LOT from customers and I never can share something official.

Re: License and Support Expired Behaviors

PhoneBoy — Mon, 15 Jul 2024 21:22:48 GMT

IPS has an SK about it specifically: https://support.checkpoint.com/results/sk/sk44175
So does App Control: https://support.checkpoint.com/results/sk/sk56300

Again, a Firewall or Management license typically don't expire outside of evaluations.

Re: License and Support Expired Behaviors

the_rock — Mon, 15 Jul 2024 21:26:41 GMT

There is no official statement about it or link/sk. What happens is this...if mgmt license expires, you cant log into smart console, thus you cannot install policy through it. If fw one expires, yes, traffic will still pass, but you cant get new IPS/URLF updatesor make any changes that require valid contract.

Andy

Re: License and Support Expired Behaviors

firebird — Sat, 23 Nov 2024 15:12:49 GMT

I have an interesting one, I have CP1490 local managed. EOL now, contract expired on blades but FW, VPN, Routing and Identity is set to never expire. But lately been seeing on the notification screen License Activated. License set to expire on Jan 18, 2038. This was after being provided with a custom build to B163 on site is B160.
Not sure if this is a firmware issue or something at the backend with Checkpoint. I do get the random notification that my contracts have expired and to contact checkpoint.

any thoughts?

Re: License and Support Expired Behaviors

the_rock — Sat, 23 Nov 2024 17:40:35 GMT

That sounds like something at the backend, would not make logical sense if you see 2038 lol

Andy

Re: License and Support Expired Behaviors

firebird — Sat, 23 Nov 2024 17:47:47 GMT

That’s what I figured wonder if I ignore it or report? My appliance shows active and registered and as mentioned the blade for firewall is never license

Re: License and Support Expired Behaviors

the_rock — Sat, 23 Nov 2024 18:24:19 GMT

Personally, if I were you, I would report and not ignore it. To me, thats certainly wrong, but TAC case might be warranted.

Andy

Re: License and Support Expired Behaviors

AkosBakos — Sat, 23 Nov 2024 18:39:00 GMT

Andy,

If FW lic expired you won't be able to install policy to the gateway(s), even if you have a valid SmartCenter lic. and the traffic flows according to the latest policy.

If the contract expires, that happen what you wrote.

Akos

Re: License and Support Expired Behaviors

firebird — Sat, 23 Nov 2024 19:08:50 GMT

This is an appliance GAIA image local managed and firewall license, IPSEC VPN, identity and advanced routing have a never expire license. So nothing should stop working. However my other blades that are software subscription have expired so those features of IPS, Bot etc won’t work and that’s understood. The question. Is why my gateway is saying license activated. License is set to expire in Jan 18, 2038 ? This only did it after installing a custom build from CP. if needed I will downgrade back to the last firmware image but will see if issue is related to firmware or backend of CP?

Re: License and Support Expired Behaviors

the_rock — Sat, 23 Nov 2024 19:09:42 GMT

Thats right and I believe thats what my statement implies too 🙂

Andy

Re: License and Support Expired Behaviors

Lesley — Sun, 24 Nov 2024 15:46:41 GMT

Would recommend to replace with supported hardware. I think if you open a case with eol hardware and valid license they cannot proceed with it anyway.

Re: License and Support Expired Behaviors

firebird — Sun, 24 Nov 2024 16:38:12 GMT

as mentioned keeping it as a router/switch, main firewall will be supported. I will open a TAC since they provided the private build since this occurred and will revert to previous image if needed just need to confirm if this is a firmware matter or backend due to being EOL but nonetheless I have time until 2038 to worry. Was seeking if others in the community that have same devices that are still in usage in a LAB etc. are getting this message.

Re: License and Support Expired Behaviors

PhoneBoy — Mon, 25 Nov 2024 14:56:24 GMT

I suspect the reason for the "Expires in 2038 license" has something to do with: https://en.wikipedia.org/wiki/Year_2038_problem
By default, in older versions (R77.x and earlier), we would set the expiration of the Internal CA to current date plus 20 years.
That caused issues that we've since fixed by setting the expiration date of the ICA to a fixed value: https://community.checkpoint.com/t5/SMB-Gateways-Spark/How-reset-to-factory-default-from-maintenance-mode/m-p/33146
There are likely other bugs that will occur when the actual date gets to 2038 that will cause the unit to fail...that obviously won't get fixed because the units will be EOL.

Therefore, I expect the answer from TAC will be that this is expected behavior.

Re: License and Support Expired Behaviors

the_rock — Mon, 25 Nov 2024 14:58:00 GMT

Right, I keep forgetting thats the "Epocalypse" year haha

Andy

Re: License and Support Expired Behaviors

firebird — Mon, 25 Nov 2024 15:08:51 GMT

Thanks am aware of the bug and seen the fix for R77.20 which was a link and am above that build number. But yes when I see my internal CA shows to expire on 2037. Can I extend my CA beyond 2037 or would it be done automatically by the system?

Re: License and Support Expired Behaviors

the_rock — Mon, 25 Nov 2024 15:20:21 GMT

https://support.checkpoint.com/results/sk/sk158096

Procedure - If the Internal CA certificate is still valid:

Important Note: You do not need to do steps 1 and 2 of this procedure if you have installed the Jumbo Hotfixes below. Before the release of the Jumbo Hotfix Takes, the Internal CA certificate required a manual renewal process. With these Takes, it will be automatically renewed one year before its expiration date:

Jumbo Hotfix Accumulator for R81.20 starting from Take 26

Jumbo Hotfix Accumulator for R81.10 starting from Take 95

Jumbo Hotfix Accumulator for R81 starting from Take 82

Jumbo Hotfix Accumulator for R80.40 starting from Take 198

I ran the actual script, but it simply shows now Dec 31, 2037.

Andy

Re: License and Support Expired Behaviors

firebird — Mon, 25 Nov 2024 15:31:32 GMT

Thanks Andy believe a jumbo fix also existed for R77.20 great than Build x.72956 believe

Re: License and Support Expired Behaviors

the_rock — Mon, 25 Nov 2024 15:32:22 GMT

I think so, yes.