Checkpoint License

[ma_gorkhali]

Some of my checkpoint firewalls has successfully been renewed it went up to the usercenter and automatically got updated with the extended date.

However, when I jump into smartupdate I do not see service contract getting fetched over.

Is service contract and license two different things ? I have usually seen both of them getting updated in the past but looks like license in the firewall has been updated but not the service contract in smartupdate.

[PhoneBoy]

Yes, they are two separate things.
The license allows the functionality to be used, the service contract allows you to access ThreatCloud and other updates.
The best place to review the situation is via the CLI (cplic print -x) on the relevant gateway versus SmartUpdate (which has largely been deprecated).

[the_rock]

Can you send us output of cplic print -x?

Andy

[ma_gorkhali]

@the_rock @PhoneBoy  You can find the attached screenshot below

You can see on the gateway itself license has been updated until 14Nov 2025 but the contract has not been fetched in smartupdate

[the_rock]

I agree with @Tal_Paz-Fridman . Based on the output, IPS is indeed covered, but seems URLF is expiring Dec 14th. Here is what I would try, if I were you, in the meantime...just generate local eval license good for 30 days, apply it, install policy and test.

Andy

[ma_gorkhali]

Hi @the_rock  we are only adding up IPS as we did downgrade from NGTX to NGFW as we only require IPS.

The only thing is why is it not getting reflected in SmartUpdate ? 

[the_rock]

Honestly, I would call Account services and verify.

Andy

[ma_gorkhali]

The TAC engineer that has been assigned to me doesn't know anything frankly telling you. He is providing me SK of R81.20 and telling me to follow it as it clearly mentions that the SK is not for R81.10

[the_rock]

As the saying goes, we cant control other people, we can only control what we do. Dont worry, we are here to help, so Im sure we will figure it out. Btw, what is the sk you are referring to?

Andy

[the_rock]

Btw @ma_gorkhali , thought of something that MAY work. What if you run below from mgmt ssh in expert mode?

contract_util mgmt

That command should allow management to update all gateways managed by it with the right contract info.

Andy

[ma_gorkhali]

@the_rock  for service contract I manually pulled from usercenter and uploaded it using smartupdate. 

contract_util mgmt will not work as Maestro is more based on local license rather than central licensing. Correct me if I am wrong

Sadly I am still stuck with Maestro renewal but a new tac engineer came in with new ideas. Let see how it unfolds tomorrow. I will update

[the_rock]

K, sounds good!

Andy

[Tal_Paz-Fridman]

Could you also run the following command on the Security Gateway (it uses a somewhat newer I/S relative to SmartUpdate):

cpstat os -f licensing

Thanks

[ma_gorkhali]

This is a maestro-based environment with VSX and we did downgraded the license from NGTP to NGFW on the recent renewal.

One more thing do we need to renew license for the Virtual System as well? We had initially purchased for 10 VS

[Tal_Paz-Fridman]

 In the output you can see exactly what is covered and what is not (and indeed NGTX blades are no longer covered).

I suggest contacting Account Services 1-972-444-6600 and select option 3 or at help.checkpoint.com 

[ma_gorkhali]

Hello @Tal_Paz-Fridman , thank you for replying back.

Just want to confirm is IPS renewed interms of licensing as well as service contract in my gateway? 

One more thing do we need to renew license for the Virtual System as well? We had initially purchased for 10 VS

[Tal_Paz-Fridman]

So based on the output IPS is covered.

You need to make sure the Security Gateway has access to the Internet to make the check (and also download updates). 

AFAIK the basic license which includes blades like Firewall and IPsec VPN does not need renewing. Only Service Blades like IPS, Anti-Virus, Anti-Bot, Application Control, URL Filtering etc. need updating.