Licensing Question

[NeilDavey]

Good Morning

I am migrating away from the Mobile Access VPN to a client based VPN and have a question around the licenses that I have.

In my portal, I have these = CPSB-MOB-200-HA

Looking at this document, these are Mobile Access Licenses and could be used for Check Point Mobile for Windows as well.

https://support.checkpoint.com/results/sk/sk84560

From the support Center, I have downloaded the package E87.30 Check Point remote Access VPN Clients for Windows (E87.30_CheckPointVPN.msi) and during the install, I select Check Point Mobile.  Create the site and connect ok.

 

On connecting to the VPN, in SmartView Monitor it says I am connected as Client Type Endpoint Connect.  Is this correct for the licenses that I have already?

What I don't want to happen, is to migrate my users to this new VPN and then be hit with a connection limit as I do not have the correct licenses.

Thanks for your help here.

[G_W_Albrecht · Accepted solution]

There should be no issue as licensing is valid. CPSB-MOB-200-HA is HA Cluster node license, so the other node should have a CPSB-MOB-200 installed.

[Chris_Atkinson · Accepted solution]

@G_W_Albrecht is correct.

Refer "Check Point Mobile for Windows" here:

sk67820: Check Point Remote Access Solutions - Gateway-Based Access

[the_rock]

You would have no issues.

[NeilDavey]

Thank you.  I will progress with the version I have downloaded as the correct one then.

[G_W_Albrecht]

I talked to sales and heard that licenses for Endpoint Security VPN with Desktop Firewall configured in Dashboard are not available anymore - current users can renew the licenses, but new users have to buy a Harmony EP package. Clearly, Desktop Firewall is Legacy, Harmony EP is much better security 8)

[NeilDavey]

What does this mean for my licenses then?

CPSB-MOB-200-HA

Will I come across any issue?

I have not setup the Destkop Firewall policy.

This is the rule we allow for access

[G_W_Albrecht · Accepted solution]

No, if you select Check Point Mobile for install, all is well licensed ! If you need a Desktop Firewall you have to buy Harmony.

[NeilDavey]

Thanks for the confirmation here.

[the_rock]

@NeilDavey I said this I cant even count how many times before...if I lived 1000 years, I would NEVER understand CP licensing, I really mean that. What I always do, if in doubt, I just "slap" eval license, which covers everything and dont think about it for 30 days : - )

Andy

[NeilDavey]

Thats a good solution.  It is rather confusing.

From what G_W_Albrecht has confirmed, I am all ok with the install and my current licenses.  On this basis, I will progress with my roll out.

This seems a better solution anyhow as the MAB requires JAVA and also we get issues with Admin Prompts needed for our users which is annoying and causes us issues.

[the_rock]

Well, @G_W_Albrecht is a CP legend after all, he knows his stuff! But yes, based on all that was discussed, Im fairly confident it would work.

Andy

[G_W_Albrecht]

It is a viable solution if the users have other EPS on their laptops, but for mobile phones and tablets, MAB is just fine. Also MAB provides pure clientless access to applications deployed on the internal network, see sk104577: ATRG: Mobile Access Blade

The confusing part is the Legacy CP VPN client (i can date it to 2010 or before) 8) that has later been the little brother of EPS client. So you have one installer, but the three selectable flavours have different licensing:

- SecuRemote (no Office Mode!) does need no license, only IPSec VPN blade

- Check Point Mobile (Office Mode + SCV) uses the concurrent MAB license

- Endpoint Security VPN (Office Mode + SCV + Desktop Firewall) uses per seat licenses (same as EPS client)

Reason for this is just evolution 😉

[G_W_Albrecht]

I must admit that CP licensing can sometimes be confusing, mostly in phases of new licensing methods introduction (Blade licensing and VPN client!). But just ask me, i can help sometimes...

[the_rock]

You always help Guenther 💪...to say CP licensing can be confusing is a true understatement lol. Anyway, lets leave that subject alone 🤣

[the_rock]

Eval license is your best friend...you will never have any issues with it, guaranteed! 🙂