Eval license for Management Server managing 100 Gateways

[kamaladmire1]

Hi Experts,

I’m planning to deploy a temporary (VM based) management server to support a data‑centre transition. It will only be required for a couple of days. Our current management server is managing around 100 gateways, and I need to deploy an additional secondary management server using an evaluation license.

1. What is the gateway management limit for a Check Point Management Server running on an evaluation license?

2. After performing a migrate export/import, if the newly deployed management server (VM based) uses a different IP address but still has network reachability to all managed gateways, will this affect SIC trust or require SIC to be re‑established?

3. Also if the OLD Management is running a different license SKU and NEW Management is on a different License SKU, will this cause a sync issue? 

[the_rock · Accepted solution]

1. What is the gateway management limit for a Check Point Management Server running on an evaluation license? I believe unlimited

2. After performing a migrate export/import, if the newly deployed management server (VM based) uses a different IP address but still has network reachability to all managed gateways, will this affect SIC trust or require SIC to be re‑established? I dont think thats needed

3. Also if the OLD Management is running a different license SKU and NEW Management is on a different License SKU, will this cause a sync issue? Im fairly sure it would not cause any issues

[kamaladmire1]

thanks for quick response

[the_rock]

Pleasure to help, any time!

[Bob_Zimmerman · Accepted solution]

1. The 15-day "plug-and-play" eval license definitely covers an unlimited number of firewalls. The accounts.checkpoint.com > Try Our Products > Product Evaluation > All-In-One Evaluation option should also cover a single management with an unlimited number of firewalls. The Other Evaluation Option offers an MDS eval covering five domains and 50 firewalls, or a CPSB-DMNU000, which should let one CMA manage an unlimited number of firewalls.

2. Changing the management server's IP address like this does not require reestablishing SIC, as SIC is certificate-based. Just keep the same hostname on the management, and it will be fine.

That said, changing the IP may require unloading the policy to allow the connection from the new management. The firewalls get implied rules which allow the management server to talk to them, and the new management's address won't be on the list. It you know the new management's address ahead of time, you can make a dummy secondary management object with that address and push to the firewalls to make them aware of it.

3. License SKU definitely doesn't matter for management sync.

[Vanness_Chen]

Hi Bob:

Recently, I also have a requirement to migrate an on-premises SMS appliance to a VM.

If the target version is different during the migration (for example, R81.20 → R82), would it still be unnecessary to re-establish SIC?

[emmap]

SIC certificates are retained during an upgrade with migration, no need to reset anything. The R82 install and upgrade guide has the full procedure to follow.

[kamaladmire1]

thanks everyone