SmartConsole shows No License and Contract is expired messages for IPS, AV, Application

[Tymdrake]

Hello everyone

I am experiencing the following issue. After integrating a new gateway into the Security Management Server (SMS) and applying the license, SmartConsole displays messages indicating that several Software Blades do not have valid licenses, including IPS, Anti-Virus, Anti-Bot, URL Filtering, and Application Control.

When I check the licensing information using the cplic print -x command, both the license and the contracts appear correctly installed. I also found and followed the procedure described in SK183287; however, it did not resolve the issue.

I have already opened a case with the TAC, but I would like to know if anyone has encountered this issue before and how it was resolved.

Both the Security Management Server and the gateway are running R82 with Jumbo Hotfix Accumulator Take 91.

[Lesley]

I would export contract files from the usercenter and use Smartupdate to import the contract files, after that policy push

[Tymdrake]

Thank you very much for your suggestion, Lesley.

I have already repeated these steps, but the issue persists and the behavior remains unchanged.

I also deleted the license from the container and regenerated it. Then, I attached the license to the gateway using both SmartUpdate and the CLI, but the problem still occurs.

[Lesley]

What do you see here on relevant gateway?

cpstat os -f licensing

Is this VSX? Can you check if all gateway can access internet? test with curl_cli -vk https://updates.checkpoint.com

[Lesley]

Oh just check out the sk's below

https://support.checkpoint.com/results/sk/sk183287

https://support.checkpoint.com/results/sk/sk168673

[Tymdrake]

HI Lesley 

I ran the command, and this is the result, If you see some blades show not entilted, but the licences covered that, I attach a cplic print output.

Thanks 

[Lesley]

I think you run vsx, try to follow my shared sk's and make sure all vs can reach internet!

IPS should be enabled on vs0 and relevant vs system you want to run ips 

you have license for 2 VS systems, those vs also need internet access.

vsenv 0 -> curl test as shared before

vsenv 1 -> same test

etc

[Tymdrake]

Hi Lesley 🙂

I am not using VSX. This is a standalone firewall and is not currently configured as a cluster.

In the future, it will be configured as a ClusterXL environment, but at the moment it is operating as a single firewall.

I applied the procedure described in SK183287 yesterday; however, the issue still persists.

I have opened a case with the TAC, and we have a support session scheduled for tomorrow to review the issue.

I will let you know the diagnosis and the solution once we complete the session. In the meantime, I will continue checking other options and try to solve this jejeje 

Thanks 

[Tymdrake]

Hi Lesley, ‌‌

The issue has been resolved.

For some reason, even though the appliance already had the license and contracts installed, it was unable to update the internal database (entitled.C).

We configured the appliance as a member of a cluster, since that is how it is intended to be set up in the final configuration. Once this was done, the contracts and licenses were updated successfully.

Everything is now displayed correctly in SmartConsole, and there are no longer any licensing errors.

Thanks for your help