Does license creation process differ for R81.10 and R81.20?

[kamilazat]

Hello all.

We are confused as to which IP address to use while creating licenses for each SGM.

We found SK180461, where using the mgmt IP of the Security Group is recommended, an only R81.20 is mentioned in the article.

And there is SK163323, where using the sync IP is suggested for use for each SGM while creating the licenses. Here previous versions are listed as well as R81.20.

So we are confused as to which IP to use while creating licenses for each SGM. Does the IP change when creating licenses for SGMs depending on the version really?

Additionally, in the User Center 'Management Information' box needs to be filled. We normally use the IP of the SMS there. In case we use MDS, do we need to use the domain's IP where Maestro is managed or the Global Domain's IP?

Thanks in advance for the clarification.

Cheers!

[emmap · Accepted solution]

The old licensing process (use the sync IP) works for all versions, including R81.20 onwards.

The new process (sk180461) works for R81.20 onwards. 

The automatic license fetch will still use the sync IP, in all versions.

Use whatever process you are most comfortable with that works with the version you're running. The management IP would be the DMS IP where the Maestro is managed in a multi-domain environment.

[kamilazat]

I see. I have an additional question then.

Let's assume I want to get a trial license for IPS. Then I will treat the whole thing as a normal gateway (the mgmt IP that appears on the orchestrator). Is this correct? And if yes, how does it work with double site?

[emmap]

I think you can do one eval to the security group's management IP and apply it with g_cplic put in that case. 

[AkosBakos]

Hi @kamilazat 

Usually, the SMG downloads its cert from the usercenter. 

Did it happen, or not? In licensing question we follow the Admin Guide:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Maestro_AdminGuide/Content/T...

And this sk: https://support.checkpoint.com/results/sk/sk163323

In short:

Note - R81.20 supports the license settings procedure (with the Sync IP) from versions below R81.20 (see sk163323).

The new procedure is simpler and is recommended for R81.20 and higher versions.

My last personal experience, we used the "oldschool" licensing -> we used the SYNC IP of the SGM-s

Akos