Behavior of the subscription blade policies after expiration

[Vladimir]

Please advise on how are the policies and rules created for IPS, DLP, AV, AB, APPC, URLF, etc., will behave should the client's subscription lapse.

Thank  you,

Vladimir

[Alisson_Lima]

Hello Vladimir,

The enviroment will continue to work, but theses blades need of update from Check Point Cloud for download new signatures, sites categories and solutions for malwares and virus and it's only possible with a valid contract.

I hope help you.

Alisson Lima

[PhoneBoy · Accepted solution]

The policies and rules will remain.

However, there will be no enforcement of that blade's security policy.

There is a grace period for some blades:

• IPS (for historical reasons) has a fairly complex set of rules: IPS Software Blade contracts in R71 and higher
• For App Control: How to check if a Security Gateway is covered by an Application Control Software Blade contract in U... 

[Olga_Kuts]

Hi Dameon,

Will the last policy not work either?
I'm interested in Anti-Virus, Anti-Bot, URL Filtering and Anti-Spam.

[PhoneBoy]

No, enforcement on those blades will cease once the contract expires.

[XuanThinh96]

Hello PhoneBoy,

I have a question, If my unit expired license (Application Controll and URL Filltering), Can I used object Custom Applications/Sites?. Behavior my unit expired the license (Application Controll and URL Filltering) when I use Object Custom Applications/Site? Is it possible to block the web?

Example: My unit haven't the license (Application Controll and URL Filltering), and I want block website: Facebook and youtube, can I use Custom Applications/Site ?

[Chris_Atkinson]

A valid license is required per sk56300 and there is no longer a grace period without eval licenses.

FQDN/Domain objects in the access (Firewall) policy are a different option depending on the use case.

[Gaurav_Pandya]

Yeah.

Policies & Rules will work as expected but new signatures/ Updates/ Category will not be fetched for particular blades

[Vladimir]

Since now the policy could be unified, some objects, such as "Internet" from AppC may be present.

There are also default cleanup rules in AppC and URLF policies.

If, as Dameon states, there will be no enforcement of that blade's security policy, how will the rules containing objects from those policies be processed?

Specifically, in unified not-layered cases.

Another example of concern is situation when, for example,There is a separate layer of AppC and URLF with explicit rule permitting https and ssh access, for example, to gateways, with default implicit rule set to drop.

Which rule will end-up being enforced once this subscription expired?

Will it default to all open?

Gaurav,

Please see Dameon's reply above yours: Existing protections will not continue to work after expiration of the grace period.

I.e. in case of Application control: "If a valid Application Control contract is not associated with a gateway, the blade will be disabled."

So, it is not only affecting new signatures, categories, etc...

Thank you,

Vladimir

[Tal_Ben_Avraham]

Blade's relevant object defined on a layer while the blade's contract is expired will just not be matched (all blade's relevant rules will be filtered out).

E.G:

Rule 1: Src: Any Dst: Any App: Skype Action: Drop

Rule 2: Src: Any Dst: Any App: Any Action: Accept

In case Application contract is expired rule 2 will always be matched.

Hope that clears things out.

[Vladimir]

So, just to be clear, if you have these rules in unified policy:

1. I will lose WebUI and SSH access to the gateway

2. I will lose Internet access from Net_192.168.7.0

And if I have it in sequentially processed App Control and URLF policy, same thing will happen, unless I have duplicate rules in Firewall policy allowing this traffic, but with "Internet" object replaced with either "All-Internet", "ExternalZone" or "Any"?

[PhoneBoy]

HTTP and SSH do not rely on Application Control signatures, so will not be impacted by an expired App Control license.

[Tal_Ben_Avraham]

The inline layer in your example does not contain any application. So you will not lose internet access.

The only thing you will lose in this example is the application logs for connections matching rule 10.1.

[Gaurav_Pandya]

Oh ok.

[Vladimir]

Please note that the inline layer shown contains single App Control and URL filtering blade.

If the blade's functionality is disabled after contract expiration, will these rules be treated as Firewall blade rules or the entire shebang will stop working?

In particular, the "Internet" object depicted is only available when the App Control is activated.

[PhoneBoy]

They'll be treated as firewall rules.

It's entirely possible you'll also get an error on pushing policy in this situation as well. 

[JASPAL_SINGH]

Hi Dameon.

After going through the discussion, I can understand that after the license & contract expire App Control and URL filtering blade will be disabled and as you say there will be no enforcement of that blade's security policy.

I have small query like do we able to push the policy package or we get the error and policy installation fails ?

We can only able to push the policy after disabling the rules related to specific blade ?

Regards,

Jaspal Singh

[PhoneBoy]

You will definitely get an error message when you push policy in this case.

However, it should allow the policy push, but the relevant rules won't work. 

[Gaurav_Kansal]

Dear Fellow Gentaleman's,

My MDS License & Contract will expired in this month but the VSX attached to this MDS is having license upto Dec-2019. So I have some queries regarding this issue::

1. If my MDS Contract will pass the grace period so can I able to open Smart Domain Manager  or Smart Dashboard of any of my CMA after expiring the contract or not?

2. if it will open thereafter too so can I able to push the policy to the security gateways or not?

3. I think the Relevant Blades like IPS, Anti Bot, Antuvirus will not work so I will disable those blades earlier too, am i right?

4. Is there any way to take backup of the topology like details of Groups, Network Objects, Host Objects & in all whole topology before passing the grace period too., Please suggest me.

Thanks & Regards,

Saurabh/Gaurav

[CSharp]

Our contracts expired a few days ago, we are awaiting for the renewal PO to get pushed through now. 

Thought it important to note that we are unable to install policy at all. It says the URL filtering blade has been deactivated and the policy push fails immediately.  We're on the latest take of R80.30.

Unfortunately, we had a similar situation with R77.30 a few years back and were able to install policy without issue then.

[PhoneBoy]

It's possible we've changed the grace period in more recent versions.
In any case, an evaluation license can be used to bridge the gap.

[CSharp]

Seems like it. Our VAR recommended that as well, but also said they should have our renewal through today, so we decided to wait. Thanks for the quick response!

[jpwgc]

Can an evaluation licensed be applied over top of an expired license though or does the OS have to be reloaded first?

[PhoneBoy]

Yes you can apply an Eval license over an expired license without reinstalling.

[sjpearson]

Only consideration is if you are running the software on open server. When you unlock the number of cores available by applying an eval licence, a reboot is required. 

[Timothy_Hall · Accepted solution]

Looks like R81.10 Jumbo HFA 93+ has added a 90-day licensing grace period for Compliance/SmartEvent & APCL/URLF/TEX features.

PRJ-43895, PMTR-89750	Security Gateway	NEW: We have extended the grace period of Compliance blade to support you for 90 days following contract expiration to continue providing the best security value during the renewal process.
PRJ-43807, PMTR-89699	Application Control, URL Filtering	NEW: We have extended the grace period of Application Control and URL Filtering blade to support you for 90 days contract expiration to continue providing the best security value during the renewal process.
PRJ-44255, PMTR-90165	Threat Extraction	NEW: We have extended the grace period of Threat Extraction blade to support you for 90 days following contract expiration to continue providing the best security value during the renewal process.
PRJ-43910, PMTR-89774	SmartView	NEW: We have extended the grace period of SmartEvent blade to support you for 90 days following contract expiration to continue providing the best security value during the renewal process.

[PhoneBoy]

Good catch!
Hopefully this will also be in R80.40/R81 for those customers that need it.

[e1pex]

Look like the change is in Take 82 for R81 as well.

PRJ-43894, PMTR-89750	Security Gateway	NEW: We have extended the grace period of Compliance blade to support you for 90 days following contract expiration to continue providing the best security value during the renewal process.
PRJ-44254, PMTR-90165	Threat Extraction	NEW: We have extended the grace period of Threat Extraction blade to support you for 90 days following contract expiration to continue providing the best security value during the renewal process.
PRJ-43806, PMTR-89699	Application Control, URL Filtering	NEW: We have extended the grace period of Application Control and URL Filtering blade to support you for 90 days following contract expiration to continue providing the best security value during the renewal process.
PRJ-43909, PMTR-89774	SmartView	NEW: We have extended the grace period of SmartEvent blade to support you for 90 days following contract expiration to continue providing the best security value during the renewal process.