Can't activate Monitoring blade on R81.10 Cluster PAYG in Google Cloud

[johnnyringo]

As the title states, we've launched a few R81.10 clusters inside Google Cloud Platform with a PAYG license.  The error message when pushing policy is:

No sufficient licenses installed for Security Gateway with Monitoring Blade.  If you do not intend to use SmartView Monitor, please uncheck this product from your Security Gateway(s)

Other blades like Content Awareness, URL Filtering, VPN, and IDS/IPS/Anti-Bot have been activated and operating fine.  

I am able to activate the blade on BYOL licenses without issue, so this seems specific to PAYG. 

[the_rock]

Thats exactly reason why it fails. I cant recall is there is a way to get around it, but will double check my notes.

[johnnyringo]

Well, yeah, LOL.  Always fun when you do a PAYG license and pay 3x as much for something that doesn't even work.

[the_rock]

Tell me about it LOL. Anyway, Im still trying to find what was final outcome.

[johnnyringo]

Thanks, appreciate the reply as it's helping me maintain mental sanity.  Per usual, I'm getting gaslit by Checkpoint support as they're claiming the Monitoring blade "only works on management server".

[the_rock]

No offense, but wheoever told you that, either they confused mgmt with gateway, or they had not done any checking. Monitoring blade is SPECIFIC to gateway only, you cant even enable it on the mgmt server, as its not possible and even if it was, it would be utterly pointless/useless.

[johnnyringo]

No offense to me.  That's exactly what I told them.  And I'm not even a Checkpoint expert by any means.  

[the_rock]

All that person had to do is spend 30 seconds and open demo dashboard (not even working lab), edit mgmt object and see exactly what we said. 

[PhoneBoy]

TAC is correct, the monitoring blade is, in fact, a Management license.
In my "All-in-One" evaluation license, I see the SKU CPSB-MNTR associated with the other parts of my Management license.
It's also noted as such in the Product Catalog:

[the_rock]

Thats true, license is spsb-mntr installed on mgmt server, BUT, the feature itself is ONLY available on the gateway, not management server.

[PhoneBoy]

You can't enable it on a Management Server, yes.
However, in order to enable it on managed Security Gateways, your management management must have a license that includes CPSB-MNTR.

[the_rock]

Yes sir, 100% agree 👍

[johnnyringo]

We're using PAYG for the management server as well.  So....I guess paying an astronomical rate for a PAYG license isn't good enough and we have to shell out some more dough?  

[PhoneBoy]

You should confirm if your management includes this feature by checking the output of cplic print and looking for CPSB-MNTR in the license string.
To the best of my knowledge, it should be included in current management SKUs.

[johnnyringo]

Yeah already did that and it's not there.  TAC closed the case this morning for this reason.  

I've re-opened the TAC case, but looks like this is yet another one for the legal department to handle.  

[PhoneBoy]

If you haven't already, I recommend reaching out to your Check Point SE regarding this.