SIC - License

[RemoteUser]

Hi Mates!!
Quick question:
If I reset the SIC on the firewall, could this cause any issues with the licenses?
Or are licenses completely independent from the SIC?

[_Val_ · Accepted solution]

This really depends.

If you are using a central license, it will remain intact on the management, but may need to be reassigned to the GW after setting new SIC.

If the license is local, it will remain on the GW.

In either case, resetting SIC on the GW side will revert GW to the initial policy state.

[RemoteUser]

thanks @_Val_ 

[NicklasBargell · Accepted solution]

Please bear in mind that when SIC reset is performed the firewall will not process traffic according to your policy, it will be processed according to what we call the "initial policy": The Initial Policy.

This can cause a traffic interruption if not done in the correct order. Here is some useful information: sk65764 - How to reset SIC

Regards,

Nicklas

[the_rock]

One way to get around it is to use below method, reset sic without cprestart, that would not load initial policy.

https://korkutozcan.com/how-to-reset-sic-without-restarting-check-point-gw/#:~:text=The%20normal%20w....

[_Val_]

The post is very old, the rest is irrelevant and proven incorrect.

I have to say, this hack is absolutely NOT SUPPORTED and is essentially very old in the first place. Mentioning of obsolete appliances would be the first sign

[the_rock]

Ohhh...honestly, had no idea. I had given it to few people recently, worked really well, even in brand new versions. Anyway, good to know.

[Bob_Zimmerman]

It's definitely supported, and listed as working on R82.10:

sk86521 - How to reset SIC with a Security Gateway without restarting the Check Point services

[the_rock]

Thanks for confirming Bob!

[_Val_]

@Bob_Zimmerman, that's fair. I did not look it up. I modified my original response to make sure there is no confusion.

[PhoneBoy]

There's an actual SK on resetting SIC without restarting: https://support.checkpoint.com/results/sk/sk86521 
Believe it's the same commands as mentioned in this post. 

[the_rock · Accepted solution]

Hey brother,

Put it this way. That would not do anything to the license...resetting SIC actually loads initial policy, so you need to install correct policy afterwards to get thigs working. Regardless of license type, it will stay there, wont be removed.

[the_rock]

@RemoteUser 

If you feel more comfortable, we can do quick remote and I can demonstratre this in the lab on one of my R82 firewalls.