- Products
- Learn
- Local User Groups
- Partners
- More
In recent years, I have read and heard many questions about licensing in Maestro environments.
Therefore, here is a brief summary of the licensing model.
Important:
In R81.20 and higher versions, you can use the Security Group Management IP as the IP for the license string.
Here you can find the SK for the R81.20+ model: License for Maestro setup - R81.20 new features
Here is an example with two MHOs, two security groups, and eight physical security gateways:
Therefore, here is a brief summary of the licensing model.
Maestro Orchestrators "MHO" |
Maestro Orchestrators (e.g., MHO-140, MHO-170, MHO-175) do not require any license.
Management Server |
Each Security Group counts as one “gateway object” on the Management Server.
So, even if a Security Group has 2, 4, or 8 appliances, it is still managed as a single gateway from a licensing perspective. Therefore, you need a Security Management license (NGSM) that supports the number of Security Groups you plan to manage.
Example:
1 Security Group → need 1 NGSM gateway license on the management.
5 Security Groups → need a license like CPSM-NGSM5 (5 gateways).
Physical Appliance |
Each physical security appliance (member) in the Security Group requires its own standard Security Gateway license.
Licensing is per gateway appliance, not per Security Group or Orchestrator. In R81.20 and higher versions, you can use the Security Group Management IP as the IP for the license string. Here you can find the SK for the R81.20+ model:
License for Maestro setup - R81.20 new features (sk180461)
These are the same licenses used for standalone gateways — typically:
- NGFW
- NGTP
- NGTX bundles, depending on the feature set (Firewall, IPS, Application Control, Threat Prevention, etc.).'
All SG members should have identical licenses and enabled blades to ensure consistent behavior across the group.
Therefore, there are two ways to license the security gateways within a security group. The traditional method using the internal IP addresses of the gateways, or, starting with R81.20, the new method using the management IP address of the security group.
| Traditional way |
The licenses within the Security Group are bound to the internal IP address of each gateway. The internal IPs within a Security Group are always the same and are automatically assigned by the Maestro environment.
Here is an example of an traditional way NGTP license assignment within a Security Group:
| Gateway / Appliance | internal IP | License |
| GW1 | 192.0.2.1 | NGTP |
| GW2 | 192.0.2.2 | NGTP |
| GW3 | 192.0.2.3 | NGTP |
| ... | ||
| GW(X) | 192.0.2.(X) | NGTP |
Important:
In the case of dual-site licenses, there is an additional jump in the sequence of internal IP addresses.
| New way R81.20+ (sk180461) |
Starting with version R81.20, Maestro Autoscaling was introduced. As a result, the licensing model had to be changed, since appliances can now be automatically added to a security group. Because of this, static assignment is no longer possible. Therefore, a new licensing model was introduced.
- Each SGM must have a different license. To create a license, enter the IPv4 and the appliance's Certificate Key (CK).
- For the license IP, use the Security Group's management IP. It is the same for all SGMs in the group.
- For the appliance's CK, use the MAC address of the management interface.
Here is an example of an NGTP license assignment within a Security Group:
| Gateway / Appliance | SG IP | License |
| GW1 | SG Management IP | NGTP |
| GW2 | SG Management IP | NGTP |
| GW3 | SG Management IP | NGTP |
| ... | ||
| GW(X) | SG Management IP | NGTP |
|
|
Each VSX/VSNext Security Group requires its own license. Each VSX Cluster license covers a predefined number of Virtual Systems (3, 10, 25, and 50), and these licenses are cumulative. The VSX licenses are applied in addition to the Security Gateway license (container and Software Blades).
Please note that VSLS (for example CPSB-VS-10-VSLS) or HA licensing is not supported on Maestro deployments.
Normally, the VSX licenses are always included with the MHS appliance bundles when you order larger systems. I’ve attached an excerpt from the data sheet of a 19100 appliance. If you use this license, it should be visible in the User Center, and you can install it in the security group.
Important!
Keep in mind that you also have a management license NGSM for each VS on the management server.
You do not need a license for the management server for virtual switches.
Quick Summary |
| Component | License Needed | Notes |
| MHO | None | No license required |
| Security Management Server | NGSM license | One SG = one security gateway |
| Security Group Members |
Security Gateway license (NGFW/NGTP/NGTX) |
One per physical appliance |
Normally, the VSX licenses are always included with the appliance bundles when you order larger systems. I’ve attached an excerpt from the data sheet of a 19100 appliance. If you use this license, it should be visible in the User Center, and you can install it in the security group.
If you need more VS licenses than the ones included, you should order them through your local partner, either together with or after your initial order. This way, you’ll always receive the correct VS licenses.
| User | Count |
|---|---|
| 15 | |
| 7 | |
| 5 | |
| 4 | |
| 3 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 |
