vesc_lic_cli auto renewal?

[LazarusG]

Hi

In the case where cloudguard clusters have central CPSG-VE+X licenses distributed via the vsec_lic_cli tool on the management server; do you know what happens when the license expires and is renewed?

Does the mgmt server acquire the new license from UC and distribute it accordingly?

Or do we need to manually apply the new license?

I don't think it's described in the documentation (other than the initial manual license application);

https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Central_License_Tool_Admin...

I imagine that if its a new license we will need to walk through this process again.

Or will the existing license simply have the contracts/subscriptions updated on UC and acquired by the mgmt server?

Many Thanks

LG

[Bryan-Smith · Accepted solution]

@LazarusG 

Best Practice - We recommend that the single Management Server and the Multi-Domain Server (when you work in Domain mode) have connectivity to the Internet. Internet connectivity lets the tool to automatically import the contracts of the licenses from the User Center. If you do not have Internet connectivity, then you must import the blade contracts manually.

https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Central_License_Tool_Admin...

[LazarusG]

Thanks, much appreciated. Ill feedback on outcome.

[the_rock]

What @Bryan-Smith gave you is definitely true. I also confirmed the same with license folks this morning.

Andy

[LazarusG]

Hi - well the renewal was processed but on a new CK - vsec_lic_cli did indeed know about the new CK without our intervention, but it didn't distribute it to the 16 AWS gateways, they stayed subscribed to the expired one. We just chose the option to change the default pool and it seems to have worked. However If I hadn't put the 16 VE evals on then there would have been a problem. So my personal experience is that it's automated upto a point (unless I have missed a step).

Also I wonder if they had put the licenses in a new UC (Like sometimes seems to happen) if it would have failed and needed the manual process to add the license (?) Thanks!