R82 Maestro License

[Sann]

My setup consists of an MHO140 and one 9100 device. The deployment has been completed, but when I try to import the temporary license through SmartUpdate, it doesn’t take effect—I can’t even delete it. I’ve tried various methods but still can’t activate the license. Could anyone advise on how to import a temporary license in R82? I attempted via CLI using management IP, synchronization IP, and Mgmt IP, but all return the same error:

"This license cannot be installed on the local machine:
The license IP Address does not match any of the local machine's IP Addresses.
If this license has an IP Address of the Security Management, use SmartUpdate to install it."

[Lesley]

create license based on mgmt ip and use g_cplic to put it all gateways. 

Here is the documentation for it (step 2) https://support.checkpoint.com/results/sk/sk163323

[Sann]

I've also found the SK you mentioned, and followed the steps outlined there to import the license file. But strangely enough, I still get the same error prompt during the import process. I really can't figure out where the problem is. Could it be that the temporary license for version R82 has any special requirements for the import method?

[emmap]

The SK states how to do it using the 'g_cplic put' method, not using a license file. Don't use SmartUpdate to license Scalable Platform gateways.

[Sann]

I want to confirm which IP address I should actually use. I highly suspect that I applied for the temporary license with an incorrect IP address. Could you please tell me the exact IP address to use? And could you provide the specific method for checking it? Is it the eth1-Mgmt IP of the gateway, the IP of the security group, or the interconnection IP between MHO and the gateway? Please let me know. Thank you for everyone!

[emmap]

Either the eth1-Mgmt1 IP address (which we would typically assume is also the IP of the security group) or the Sync IP of each individual SGM. If you're doing an eval, set it to the eth1-Mgmt1 IP address and apply it with g_cplic put so your one eval will apply to all SGMs.

[Martijn]

Hi,

Maestro uses local licensing per SGM and you need to license the SGM with the IP-address of the internal IP of the Security Group Members.

SGM1: 192.0.2.1
SGM2: 192.0.2.2
etc,etc

Copy the license to the appliance and use the 'cplic put -l' command to add the license. If you have a Security Group as VSX gateway, do not forget the attach the VS blade first before generating the appliance.

The Orchestrators do not use a license.

Regards,
Martijn

[emmap]

The licensing procedure was updated in R81.20 and again in R82.10, documented in the SK linked above. The mgmt IP can be used now, and is preferable to do that way when doing evals (so you only need one eval for all SGMs).

[Martijn]

Thanks. You learn everyday 😁.

[Wolfgang]

It will be better and easier to use the "newer" license way via the IP address of the SecurityGroup. You can create all your licenses for this IP address and add them via cplic put on the SMO. The other SGMs will receive them from the SMO.

Follow exactly the steps in https://support.checkpoint.com/results/sk/sk163323

[todd]

If I upgrade from R81.10, what will happened in SGMs license ?

1. work as usual, no need to do anything ?

2. re-apply "newer" license way via the IP address of the SecurityGroup and add them via cplic put on the SMO  ?

Thanks!

[Wolfgang]

No need to change.

Your existing licenses will work. You can do the licensing via old or new way. The newer way is a simple process but the old one does work.

[the_rock]

Im no maestro expert by any means, but as far as licences, I always suggest to people to verify with Account services on that.