Question about virtual licensing

[cdooer]

Hi there. We've been looking into buying some new appliances, and splitting them up into virtual firewalls. As far as licensing/subscriptions are concerned, are there any cost benefits to doing it this way, rather than just buying new pairs of appliances? In several of our data centers, we've got 5 or 6 pairs of gateways performing important security duties, but they are severely underutilized. Wondering if it would be more cost effective to roll all of these into a pair of larger pair of appliances, and split them out using the virtual technology. The yearly subscription costs are quite high.

[the_rock]

Interesting thought, but not sure licensing works like that...you could confirm with account services.

Andy

[Vincent_Bacher]

As Andy already mentioned,  this should be calculated and compared. 

If you buy separated appliances,  you purchase license ans subscription for all required blades  and support for every appliance.

When using VSX you need bigger hardware to cover all systems and in addition a virtual systems package. 

I never cared about costs so account services is best address to calculate the best option for your needs.

[Bob_Zimmerman]

The big downside to doing this with VSX is it isn't really virtual in any meaningful sense. All VSs share the same version, the same OS, the same hard drive or SSD, and so on. If the box has a problem, all of the contexts on it also have a problem. It greatly increases the impact domain of failures or maintenance. I have seen some environments still running R67 (end of support before 2014) because they can't get everybody using the firewall to agree to a change window long enough to upgrade.

Edited to add: VSX on a larger box is definitely vastly less expensive than a bunch of separate smaller boxes, though. As long as you're okay with the larger potential impact, it can save ridiculously huge amounts of money. I've got a VSX pair right now running ~$300k worth of licenses on $45k worth of open servers. Replacing those boxes with non-VSX appliances would cost a minimum of $4M, just due to all the different routing tables.

[PhoneBoy]

The answer is: it depends.
In some cases, you may want to combine using VSX, in other cases: not.
If you have gateways with different tolerances/requirements for downtime and such, you may want to keep those separate.