License and Support Expired Behaviors

[spinazdoo]

Hi Check Point,

I got a question, which I thought was simple but I was confused about answering it because there was no official statement in the admin guide or SK.

This morning head of CISO asked what happens if the Check Point license expires on the firewall and management side?

I found several links that show in the IPS part that the license has expired but not other features and impacts on the management and firewall itself.

Maybe I missed it, does anyone have a link or official statement about this?

Thank you 🙂

[PhoneBoy]

The likely reason there is not an official SK about this situation is because Firewall and Management licenses are usually sold as perpetual licenses (thus don’t expire).
They also do not have a contractual component  like Application Control and Threat Prevention, which require a subscription.
The output of cplic print -x from all relevant nodes can be used to confirm your license/contract status for the various features.

If the Firewall license actually expires, the gateway will effectively “fail closed” (loading defaultFilter, which passes no traffic).
If the Management license expires, you will not be able to connect with SmartConsole or the API.
These behaviors can be easily verified by building an environment with evaluation licenses and changing the clock past the expiration date.