- CheckMates
- :
- Products
- :
- General Topics
- :
- Re: Checkpoint License
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Checkpoint License
Some of my checkpoint firewalls has successfully been renewed it went up to the usercenter and automatically got updated with the extended date.
However, when I jump into smartupdate I do not see service contract getting fetched over.
Is service contract and license two different things ? I have usually seen both of them getting updated in the past but looks like license in the firewall has been updated but not the service contract in smartupdate.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, they are two separate things.
The license allows the functionality to be used, the service contract allows you to access ThreatCloud and other updates.
The best place to review the situation is via the CLI (cplic print -x) on the relevant gateway versus SmartUpdate (which has largely been deprecated).
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you send us output of cplic print -x?
Andy
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I agree with @Tal_Paz-Fridman . Based on the output, IPS is indeed covered, but seems URLF is expiring Dec 14th. Here is what I would try, if I were you, in the meantime...just generate local eval license good for 30 days, apply it, install policy and test.
Andy
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @the_rock we are only adding up IPS as we did downgrade from NGTX to NGFW as we only require IPS.
The only thing is why is it not getting reflected in SmartUpdate ?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Honestly, I would call Account services and verify.
Andy
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The TAC engineer that has been assigned to me doesn't know anything frankly telling you. He is providing me SK of R81.20 and telling me to follow it as it clearly mentions that the SK is not for R81.10
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As the saying goes, we cant control other people, we can only control what we do. Dont worry, we are here to help, so Im sure we will figure it out. Btw, what is the sk you are referring to?
Andy
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Btw @ma_gorkhali , thought of something that MAY work. What if you run below from mgmt ssh in expert mode?
contract_util mgmt
That command should allow management to update all gateways managed by it with the right contract info.
Andy
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@the_rock for service contract I manually pulled from usercenter and uploaded it using smartupdate.
contract_util mgmt will not work as Maestro is more based on local license rather than central licensing. Correct me if I am wrong
Sadly I am still stuck with Maestro renewal but a new tac engineer came in with new ideas. Let see how it unfolds tomorrow. I will update
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
K, sounds good!
Andy
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you also run the following command on the Security Gateway (it uses a somewhat newer I/S relative to SmartUpdate):
cpstat os -f licensing
Thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is a maestro-based environment with VSX and we did downgraded the license from NGTP to NGFW on the recent renewal.
One more thing do we need to renew license for the Virtual System as well? We had initially purchased for 10 VS
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In the output you can see exactly what is covered and what is not (and indeed NGTX blades are no longer covered).
I suggest contacting Account Services 1-972-444-6600 and select option 3 or at help.checkpoint.com
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @Tal_Paz-Fridman , thank you for replying back.
Just want to confirm is IPS renewed interms of licensing as well as service contract in my gateway?
One more thing do we need to renew license for the Virtual System as well? We had initially purchased for 10 VS
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So based on the output IPS is covered.
You need to make sure the Security Gateway has access to the Internet to make the check (and also download updates).
AFAIK the basic license which includes blades like Firewall and IPsec VPN does not need renewing. Only Service Blades like IPS, Anti-Virus, Anti-Bot, Application Control, URL Filtering etc. need updating.