License and Support Expired Behaviors

[spinazdoo]

Hi Check Point,

I got a question, which I thought was simple but I was confused about answering it because there was no official statement in the admin guide or SK.

This morning head of CISO asked what happens if the Check Point license expires on the firewall and management side?

I found several links that show in the IPS part that the license has expired but not other features and impacts on the management and firewall itself.

Maybe I missed it, does anyone have a link or official statement about this?

Thank you 🙂

[PhoneBoy]

The likely reason there is not an official SK about this situation is because Firewall and Management licenses are usually sold as perpetual licenses (thus don’t expire).
They also do not have a contractual component  like Application Control and Threat Prevention, which require a subscription.
The output of cplic print -x from all relevant nodes can be used to confirm your license/contract status for the various features.

If the Firewall license actually expires, the gateway will effectively “fail closed” (loading defaultFilter, which passes no traffic).
If the Management license expires, you will not be able to connect with SmartConsole or the API.
These behaviors can be easily verified by building an environment with evaluation licenses and changing the clock past the expiration date.

[Lesley]

I don't think there is real documentation.

I know for IPS if you enable it, run it with trial and let it expire you will get of course warnings. 

After the warnings the IPS updates stop and IPS also. Only the 'core' protections will stay active. They come from the box it self (after installation of the software) They do not require license. But this is just a small part of IPS. 

For app blade and URL blade I am not 100% sure I think it also depens on the fail-open, fail-closed setting in Smart Console. Also I would expect that the rules that contain application control objects will stop working. 

You can buy a new firewall and it will include: 1 Year SNBT Subscription Builtin. Even if you select a 2 year service plan. So after the one year you either have to renew SNBT or go back to NGTP or NGFW. 

BUT NGFW contain default IPS and application blade. So the question you ask depends on what type of blades. If it is specific IPS and application control you have to follow Phoneboy. Other blades will not be included. And what will happen depends on the blade that will expire and is enabled. 

So it is a valid question and one SK that could explain this would be great. I get this question A LOT from customers and I never can share something official. 

[PhoneBoy]

IPS has an SK about it specifically: https://support.checkpoint.com/results/sk/sk44175
So does App Control: https://support.checkpoint.com/results/sk/sk56300

Again, a Firewall or Management license typically don't expire outside of evaluations.

[firebird]

I have an interesting one, I have CP1490 local managed. EOL now, contract expired on blades but FW, VPN, Routing and Identity is set to never expire.  But lately been seeing on the notification screen License Activated. License set to expire on Jan 18, 2038.  This was after being provided with a custom build to B163 on site is B160.    
Not sure if this is a firmware issue or something at the backend with Checkpoint. I do get the random notification that my contracts have expired and to contact checkpoint.  

any thoughts? 

[the_rock]

That sounds like something at the backend, would not make logical sense if you see 2038 lol

Andy

[firebird]

That’s what I figured wonder if I ignore it or report?  My appliance shows active and registered and as mentioned the blade for firewall is never license 

[the_rock]

Personally, if I were you, I would report and not ignore it. To me, thats certainly wrong, but TAC case might be warranted.

Andy

[PhoneBoy]

I suspect the reason for the "Expires in 2038 license" has something to do with: https://en.wikipedia.org/wiki/Year_2038_problem
By default, in older versions (R77.x and earlier), we would set the expiration of the Internal CA to current date plus 20 years.
That caused issues that we've since fixed by setting the expiration date of the ICA to a fixed value: https://community.checkpoint.com/t5/SMB-Gateways-Spark/How-reset-to-factory-default-from-maintenance... 
There are likely other bugs that will occur when the actual date gets to 2038 that will cause the unit to fail...that obviously won't get fixed because the units will be EOL.

Therefore, I expect the answer from TAC will be that this is expected behavior.

[the_rock]

Right, I keep forgetting thats the "Epocalypse" year haha

Andy

[firebird]

Thanks am aware of the bug and seen the fix for R77.20 which was a link and am above that build number.   But yes when I see my internal CA shows to expire on 2037.  Can I extend my CA beyond 2037 or would it be done automatically by the system? 

[the_rock]

https://support.checkpoint.com/results/sk/sk158096

Procedure - If the Internal CA certificate is still valid:

Important Note: You do not need to do steps 1 and 2 of this procedure if you have installed the Jumbo Hotfixes below. Before the release of the Jumbo Hotfix Takes, the Internal CA certificate required a manual renewal process. With these Takes, it will be automatically renewed one year before its expiration date:

• Jumbo Hotfix Accumulator for R81.20 starting from Take 26 
• Jumbo Hotfix Accumulator for R81.10 starting from Take 95
• Jumbo Hotfix Accumulator for R81 starting from Take 82
• Jumbo Hotfix Accumulator for R80.40 starting from Take 198

I ran the actual script, but it simply shows now Dec 31, 2037.

Andy

[firebird]

Thanks Andy believe a jumbo fix also existed for R77.20 great than Build x.72956 believe

[the_rock]

I think so, yes.

[PhoneBoy]

Not currently possible.
Like I said, there are multiple areas (not just the ICA) that will need to be fixed to fully address the Year 2038 problem.
Current hardware/software versions will surely be End of Life by then.

It is something I expect we'll address in due course, but don't know the precise timeframe for doing so.

[_Val_]

If you are still running R77.20 in 2037, you have a much bigger problem than expiring ICA, I suspect...

[firebird]

So this got out of context.  Original  Inquiry was to source if others are still using this appliance and same firmware build are they getting this message? I have layers of security edge firewall, tbis appliance is used for switching and routing and works perfectly fine.  Weird that now it starts to throw that message after years of using it with different firmware build. Coincidental that after I put the last private build firmware B163 this message appeared and since no one has the answers.  I will simply revert back to build 160 over the weekend and see if that message goes away.  If it does, something was introduced as a bug If it remains with B160 and while never had it.  This leads me to believe CP backend is throwing these now.  Figured someone on this forum would have the response, rather than why continue to use it.  

[Lesley]

Would recommend to replace with supported hardware. I think if you open a case with eol hardware and valid license they cannot proceed with it anyway. 

[firebird]

as mentioned keeping it as a router/switch, main firewall will be supported.   I will open a TAC since they provided the private build since this occurred and will revert to previous image if needed just need to confirm if this is a firmware matter or backend due to being EOL but nonetheless I have time until 2038 to worry.  Was seeking if others in the community that have same devices that are still in usage in a LAB etc. are getting this message. 

[the_rock]

There is no official statement about it or link/sk. What happens is this...if mgmt license expires, you cant log into smart console, thus you cannot install policy through it. If fw one expires, yes, traffic will still pass, but you cant get new IPS/URLF updatesor make any changes that require valid contract.

Andy

[AkosBakos]

Andy,

If FW lic expired you won't be able to install policy to the gateway(s), even if you have a valid SmartCenter lic. and the traffic flows according to the latest policy.

If the contract expires, that happen what you wrote.

Akos

[firebird]

This is an appliance GAIA image local managed and firewall license, IPSEC VPN, identity and advanced routing have a never expire license.    So nothing should stop working.  However my other blades that are software subscription have expired so those features of IPS, Bot etc won’t work and that’s understood.  The question. Is why my gateway is saying license activated. License is set to expire in Jan 18, 2038 ? This only did it after installing a custom build from CP.  if needed I will downgrade back to the last firmware image but will see if issue is related to firmware or backend of CP? 

[the_rock]

Thats right and I believe thats what my statement implies too 🙂

Andy