License about to expire but Expiration Date in the past

[Roadrunner88]

Hello we have some devices with an Status of License "About to expire" but the expiration date is already in the past.

What can we do? The license itself should not be outdated.

[Maarten_Sjouw]

You should check on the gateway itself to see ifg there is still an evaluation license with cplic print -x
When it is there (probably)  use "cplic del <key> " to delete it, the key is found in the output of the previous command on the line of the eval license..

[the_rock]

Maarten made a good point, for sure. Also, can you confirm time/clock on your firewalls is correct? What does cplic print show?

Andy

[Raven]

I have a similar situation on VSX Gateway. Support suggested me procedures from (Check Point Tech Writers removed the link to an obsolete SK article).

See if this works for you. It didn't work with me on the VSX, and I still have the case open.

[Raven]

Just update...

I managed to solve my problem with steps which I get from support.

The issue seems to be an old license stuck in the database. I have to perform the below steps after taking a snapshot/backup of the management:

Do these steps on the Security Management server:

1. Delete $CPDIR/database/EntMgr_DB.xml >> mv $CPDIR/database/EntMgr_DB.xml $CPDIR/database/EntMgr_DB.xml.org
2. Run: # psql_client monitoring postgres -c "DELETE FROM entitlement WHERE 1=1;"
3. cpstop;cpstart

The SQL command is to remove the stuck evaluation license from the MGMT database.

Hope this will help you solve the problem...

[Roadrunner88]

The situation often appears on the 1570R devices

1. The device comes with a trail license installed

2. The device is installed and added to the Managemnt Server

3. The final license on the 1570R is installed correctly

4. But the Management Server shows following(see picture):

5. a restart of the 1570R doesent help

[the_rock]

You need to delete $CPDIR/conf/cp.pnp file and issue will be solved. Once you run cplic print it will complain about it, but those warnings are irrelevant.

[Roadrunner88]

ok, can i delete this file without any risk?

[the_rock]

Yes, as long as you make sure you have VALID license.

[Roadrunner88]

I tried it, but it didnt work. 

[the_rock]

You may need to do few things for it to go away fully. "get licences" from smart update, install database and install policy. I never had that fail for me.

[Roadrunner88]

also tried this...no change..hm strange

[the_rock]

What time zone you in? Im in est, lets do quick remote if you have time?

[Roadrunner88]

thanks for the offer , but its not possible right now.

i reinstalled the firewall to the management server but no change, 

I suppose, the problem is on management server side.

[the_rock]

It could be, but can you send a screenshot of the smart update what you see there? Please blur out any sensitive/private info.

[Roadrunner88]

  

[the_rock]

Sorry brother, even after 15 years experience with CP, licensing will NEVER be my "domain" LOL. Even if I was to live 200 years, I would probably never master it, haha. 

Anyway, maybe check and delete that cp.pnp file on mgmt server if it exists, if that fails, I would confirm with Account services. All I can tell is whenever I have any license issue, I just generate LOCAL eval and it works 100% of the time, so I stick with that : - )

[Roadrunner88]

Although, thanks for your help 😉

[Chris_Atkinson]

Some related workarounds are outlined here:

https://community.checkpoint.com/t5/General-Topics/Delete-trail-license/td-p/56751#M11432

Suspect we need to see the actual cplic output to offer useful suggestions however.

[Roadrunner88]

Hi Raven,

i also tried your solution. But this also had no effect.

[Tal_Paz-Fridman]

Hi, is the issue (or similar ones) still happening?

Thanks

[Roadrunner88]

Hello, no the problem is still present.

I also tried the solution from Chris_Atkinson.

[Chris_Atkinson]

Are you able to provide the "cplic print" output requested (redacted where needed)?

[Roadrunner88]

Hello,

the right license is installed and no trial license is present anymore(see screenshot)
I think the problem is on the management serve side.

[Tal_Paz-Fridman]

I'll take it up with relevant R&D owners to see how we can assist.

[Tal_Paz-Fridman]

Please share the output of the following command:

cpstat os -f licensing

[Roadrunner88]

its attached, thanks

[the_rock]

Did you double check to make sure that cp.pnp file does not exist on the mgmt server?

[Roadrunner88]

yes 

[Tal_Paz-Fridman]

Hi 

I will contact you directly with instructions on how to debug the issue.

Thanks

Tal Paz-Fridman

tfridman@checkpoint.com