topic Re: Maestro Licensing in Hyperscale Firewall (Maestro)

Maestro Licensing (VSNext)

HeikoAnkenbrand — Thu, 23 Oct 2025 12:01:28 GMT

In recent years, I have read and heard many questions about licensing in Maestro environments.
Therefore, here is a brief summary of the licensing model.

Important:
In R81.20 and higher versions, you can use the Security Group Management IP as the IP for the license string.
Here you can find the SK for the R81.20+ model: License for Maestro setup - R81.20 new features

Here is an example with two MHOs, two security groups, and eight physical security gateways:

Therefore, here is a brief summary of the licensing model.

Maestro Orchestrators "MHO"

Maestro Orchestrators (e.g., MHO-140, MHO-170, MHO-175) do not require any license.

Management Server

Each Security Group counts as one “gateway object” on the Management Server.
So, even if a Security Group has 2, 4, or 8 appliances, it is still managed as a single gateway from a licensing perspective. Therefore, you need a Security Management license (NGSM) that supports the number of Security Groups you plan to manage.

Example:
1 Security Group → need 1 NGSM gateway license on the management.
5 Security Groups → need a license like CPSM-NGSM5 (5 gateways).

Physical Appliance

Each physical security appliance (member) in the Security Group requires its own standard Security Gateway license.

Licensing is per gateway appliance, not per Security Group or Orchestrator. In R81.20 and higher versions, you can use the Security Group Management IP as the IP for the license string. Here you can find the SK for the R81.20+ model:
License for Maestro setup - R81.20 new features (sk180461)

These are the same licenses used for standalone gateways — typically:
- NGFW
- NGTP
- NGTX bundles, depending on the feature set (Firewall, IPS, Application Control, Threat Prevention, etc.).'

All SG members should have identical licenses and enabled blades to ensure consistent behavior across the group.

Therefore, there are two ways to license the security gateways within a security group. The traditional method using the internal IP addresses of the gateways, or, starting with R81.20, the new method using the management IP address of the security group.

Traditional way

The licenses within the Security Group are bound to the internal IP address of each gateway. The internal IPs within a Security Group are always the same and are automatically assigned by the Maestro environment.

Here is an example of an traditional way NGTP license assignment within a Security Group:

Gateway / Appliance	internal IP	License
GW1	192.0.2.1	NGTP
GW2	192.0.2.2	NGTP
GW3	192.0.2.3	NGTP
...
GW(X)	192.0.2.(X)	NGTP

Important:
In the case of dual-site licenses, there is an additional jump in the sequence of internal IP addresses.

New way R81.20+ (sk180461)

Starting with version R81.20, Maestro Autoscaling was introduced. As a result, the licensing model had to be changed, since appliances can now be automatically added to a security group. Because of this, static assignment is no longer possible. Therefore, a new licensing model was introduced.

- Each SGM must have a different license. To create a license, enter the IPv4 and the appliance's Certificate Key (CK).
- For the license IP, use the Security Group's management IP. It is the same for all SGMs in the group.
- For the appliance's CK, use the MAC address of the management interface.

Here is an example of an NGTP license assignment within a Security Group:

Gateway / Appliance	SG IP	License
GW1	SG Management IP	NGTP
GW2	SG Management IP	NGTP
GW3	SG Management IP	NGTP
...
GW(X)	SG Management IP	NGTP

VSX / VSNext

Each VSX/VSNext Security Group requires its own license. Each VSX Cluster license covers a predefined number of Virtual Systems (3, 10, 25, and 50), and these licenses are cumulative. The VSX licenses are applied in addition to the Security Gateway license (container and Software Blades).

Please note that VSLS (for example CPSB-VS-10-VSLS) or HA licensing is not supported on Maestro deployments.

Normally, the VSX licenses are always included with the MHS appliance bundles when you order larger systems. I’ve attached an excerpt from the data sheet of a 19100 appliance. If you use this license, it should be visible in the User Center, and you can install it in the security group.

Important!
Keep in mind that you also have a management license NGSM for each VS on the management server.
You do not need a license for the management server for virtual switches.

Quick Summary

Component	License Needed	Notes
MHO	None	No license required
Security Management Server	NGSM license	One SG = one security gateway
Security Group Members	Security Gateway license (NGFW/NGTP/NGTX)	One per physical appliance

Re: Licensing Maestro

emmap — Wed, 22 Oct 2025 07:35:01 GMT

The new licensing procedure, where you can license each SGM to the security group's management IP, is documented here:

https://support.checkpoint.com/results/sk/sk180461

It's useful for auto-scale setups.

Re: Licensing Maestro

HeikoAnkenbrand — Wed, 22 Oct 2025 08:18:16 GMT

Thank you @emmap , I’ve updated that in the description.

Re: Licensing Maestro

Henrik_Noerr1 — Wed, 22 Oct 2025 10:26:31 GMT

maybe add a description whether -VSLS licenses are supported on vsx maestro

Re: Licensing Maestro

HeikoAnkenbrand — Wed, 22 Oct 2025 10:48:54 GMT

Hi @Henrik_Noerr1, I will update the original article in the next few days to include information about VSNext licenses.

VSNext Mode using the VSX Licensing Mechanism
The VSNext mode is a new variant of Virtual System Extension (VSX).
Therefore, the same licensing rules that apply to VSX also apply here:

A VSX Gateway or VSX Cluster requires a license that allows a specific number of Virtual Systems (VS).
In a Maestro environment running VSNext, a license is therefore required that enables Virtual Systems (VS) on the Security Group.

Re: Licensing Maestro

Henrik_Noerr1 — Wed, 22 Oct 2025 11:44:23 GMT

It is my impression from my Sales Engineer that -VSLS licenses are not supported on Maestro due to a VS running active across multiple nodes. That means using the *NON* vsls version on *ALL* gateways. I could be wrong, I have not chased the topic.

Re: Maestro Licensing

the_rock — Wed, 22 Oct 2025 14:51:03 GMT

Brilliant work, as always! 🙏

Re: Licensing Maestro

emmap — Thu, 23 Oct 2025 03:34:16 GMT

-VSLS or-HA licensing is not supported on Maestro (or EXL) deployments.

Re: Licensing Maestro

Ralf_Erzinger — Thu, 23 Oct 2025 07:35:48 GMT

In the past, we also tried to install Maestro VSNext licenses. During this process, we encountered several issues that prevented the installation from completing successfully. It would therefore be very helpful to have a detailed description of the correct procedure for setting up Maestro in an environment with two security groups. Such documentation should ideally explain the necessary configuration steps, any specific prerequisites, and potential pitfalls related to permissions or group policies. Understanding the proper setup process would help us avoid similar problems in the future and ensure that the licensing and security group configuration work together as intended.

Re: Licensing Maestro

HeikoAnkenbrand — Thu, 23 Oct 2025 07:57:20 GMT

Normally, the VSX licenses are always included with the appliance bundles when you order larger systems. I’ve attached an excerpt from the data sheet of a 19100 appliance. If you use this license, it should be visible in the User Center, and you can install it in the security group.

If you need more VS licenses than the ones included, you should order them through your local partner, either together with or after your initial order. This way, you’ll always receive the correct VS licenses.

Re: Maestro Licensing (VSNext)

Lari_Luoma — Sat, 01 Nov 2025 04:02:18 GMT

This is super good information @HeikoAnkenbrand . Thanks for sharing! What we'll have to remember is that this automatic licensing model works only if the licenses are attached to the security group management address like mentioned in this post. If you use a data port to manage Maestro (not recommended) you will still need to have your management interface up and with an IP that cannot be changed. I have seen the following things happen:
A) Customer managed the SG via a data port and we ran "set management interface bond2". Licenses stopped working.
B) Customer managed the SG via a data port and changed the IP-address of the management interface because they wanted to use that IP in a data bond. Licenses were invalidated and had to be re-generated in the UC.

If you manage your Maestro via Smart-1 Cloud or otherwise use a data link to manage it, be careful that you won't lose licenses. In those cases I would be keen to recommend the old licensing mode and attaching licenses to the sync IPs (192.0.2.).

Re: Maestro Licensing (VSNext)

Lari_Luoma — Tue, 09 Dec 2025 00:00:53 GMT

I wanted to add a clarification that I got a question about.

For VSX each gateway needs their own license. Licenses are per physical appliance and not per SG. So, if you have four members in your VSX security group and need 10 virtual systems, each member must have VS-10 license.