topic Re: Checkpoint License in General Topics

Checkpoint License

ma_gorkhali — Fri, 06 Dec 2024 14:28:17 GMT

Some of my checkpoint firewalls has successfully been renewed it went up to the usercenter and automatically got updated with the extended date.

However, when I jump into smartupdate I do not see service contract getting fetched over.

Is service contract and license two different things ? I have usually seen both of them getting updated in the past but looks like license in the firewall has been updated but not the service contract in smartupdate.

Re: Checkpoint License

PhoneBoy — Fri, 06 Dec 2024 14:50:26 GMT

Yes, they are two separate things.
The license allows the functionality to be used, the service contract allows you to access ThreatCloud and other updates.
The best place to review the situation is via the CLI (cplic print -x) on the relevant gateway versus SmartUpdate (which has largely been deprecated).

Re: Checkpoint License

the_rock — Fri, 06 Dec 2024 16:13:05 GMT

Can you send us output of cplic print -x?

Andy

Re: Checkpoint License

ma_gorkhali — Sat, 07 Dec 2024 23:09:56 GMT

@the_rock @PhoneBoy You can find the attached screenshot below

You can see on the gateway itself license has been updated until 14Nov 2025 but the contract has not been fetched in smartupdate

Re: Checkpoint License

Tal_Paz-Fridman — Sun, 08 Dec 2024 06:14:10 GMT

Could you also run the following command on the Security Gateway (it uses a somewhat newer I/S relative to SmartUpdate):

cpstat os -f licensing

Thanks

Re: Checkpoint License

ma_gorkhali — Sun, 08 Dec 2024 10:46:40 GMT

This is a maestro-based environment with VSX and we did downgraded the license from NGTP to NGFW on the recent renewal.

One more thing do we need to renew license for the Virtual System as well? We had initially purchased for 10 VS

Re: Checkpoint License

Tal_Paz-Fridman — Sun, 08 Dec 2024 10:54:44 GMT

In the output you can see exactly what is covered and what is not (and indeed NGTX blades are no longer covered).

I suggest contacting Account Services 1-972-444-6600 and select option 3 or at help.checkpoint.com

Re: Checkpoint License

ma_gorkhali — Sun, 08 Dec 2024 11:01:31 GMT

Hello @Tal_Paz-Fridman , thank you for replying back.

Just want to confirm is IPS renewed interms of licensing as well as service contract in my gateway?

One more thing do we need to renew license for the Virtual System as well? We had initially purchased for 10 VS

Re: Checkpoint License

Tal_Paz-Fridman — Sun, 08 Dec 2024 12:03:53 GMT

So based on the output IPS is covered.

You need to make sure the Security Gateway has access to the Internet to make the check (and also download updates).

AFAIK the basic license which includes blades like Firewall and IPsec VPN does not need renewing. Only Service Blades like IPS, Anti-Virus, Anti-Bot, Application Control, URL Filtering etc. need updating.

Re: Checkpoint License

the_rock — Sun, 08 Dec 2024 13:55:57 GMT

I agree with @Tal_Paz-Fridman . Based on the output, IPS is indeed covered, but seems URLF is expiring Dec 14th. Here is what I would try, if I were you, in the meantime...just generate local eval license good for 30 days, apply it, install policy and test.

Andy

Re: Checkpoint License

ma_gorkhali — Sun, 08 Dec 2024 14:16:09 GMT

Hi @the_rock we are only adding up IPS as we did downgrade from NGTX to NGFW as we only require IPS.

The only thing is why is it not getting reflected in SmartUpdate ?

Re: Checkpoint License

the_rock — Sun, 08 Dec 2024 14:59:39 GMT

Honestly, I would call Account services and verify.

Andy

Re: Checkpoint License

ma_gorkhali — Sun, 08 Dec 2024 22:59:07 GMT

The TAC engineer that has been assigned to me doesn't know anything frankly telling you. He is providing me SK of R81.20 and telling me to follow it as it clearly mentions that the SK is not for R81.10

Re: Checkpoint License

the_rock — Sun, 08 Dec 2024 23:22:07 GMT

As the saying goes, we cant control other people, we can only control what we do. Dont worry, we are here to help, so Im sure we will figure it out. Btw, what is the sk you are referring to?

Andy

Re: Checkpoint License

the_rock — Sun, 08 Dec 2024 23:55:48 GMT

Btw @ma_gorkhali , thought of something that MAY work. What if you run below from mgmt ssh in expert mode?

contract_util mgmt

That command should allow management to update all gateways managed by it with the right contract info.

Andy

Re: Checkpoint License

ma_gorkhali — Mon, 09 Dec 2024 05:39:05 GMT

@the_rock for service contract I manually pulled from usercenter and uploaded it using smartupdate.

contract_util mgmt will not work as Maestro is more based on local license rather than central licensing. Correct me if I am wrong

Sadly I am still stuck with Maestro renewal but a new tac engineer came in with new ideas. Let see how it unfolds tomorrow. I will update

Re: Checkpoint License

the_rock — Mon, 09 Dec 2024 12:10:43 GMT

K, sounds good!

Andy