- Products
- Learn
- Local User Groups
- Partners
- More
AI Security Masters E7:
How CPR Broke ChatGPT's Isolation and What It Means for You
Blueprint Architecture for Securing
The AI Factory & AI Data Center
Call For Papers
Your Expertise. Our Stage
Good, Better, Best:
Prioritizing Defenses Against Credential Abuse
Ink Dragon: A Major Nation-State Campaign
Watch HereCheckMates Go:
CheckMates Fest
Hello
Can someone explain me the Difference between CPSB-VS-10-VSLS and CPSB-VS-10 blades?
BR,
Kostas
-VSLS was for use with -HA appliances or subsequent cluster members of a VSX cluster.
The first is used for HA/VSLS VSX Clustering, so part of the 10 licensed VSs will always be standby only. For this reason, it is cheaper than a VS-10 license which can have all 10 VS active.
Do I understand correct then, if you're telling part ov the 10 licensed VSs will be standby - therefore for 1 Cluster you'll only need to have 1x CPSB-VS-10-VSLS License?
please give me a short feedback.
Many thanks and best regards
Frank
For a cluster to run ten VSs, you must have at least one CPSB-VS-10.
Each cluster member after the first may have either a CPSB-VS-10 (for simplicity) or a CPSB-VS-10-VSLS (to save a little money).
It's worth nothing that -VSLS (and -HA) SKUs cannot be used in a Maestro environment.
For traditional ClusterXL or VSX clusters, you can use these SKUs.
Hi dear PhoneBoy, maybe your answer was correct 4 years ago; however, I was seeing a client account using this same SKU or similar in the Maestro environment (CPSB-VS-XX I attached a picture. This client started last year, is using this kind of license, and I saw that it's possible to use to this environment.
Please, if I'm saying something wrong, let me know, I appreciate any acceptable solution lol if I'm in the correct 🙂
Regards
The screenshot does not show -VSLS SKUs....
if you see the comment, the use case is for VSLS (and -HA) SKUs...
Yes and your SKU is not -VSLS or -HA so there is no conflict / concern.
There are 2 kinds of SKU:
CPSB-VS-25 = HA
CPSB-VS-25-VSLS=VSLS Environment
In the Comment done by PhoneBoy, basically, it includes both SKUs (he's saying that CPSB-VS-XX cannot be used in a Maestro environment). My feedback is to brief the Checkmate community that, at least from 2025, this SKU can be used in a Maestro Environment, because, in fact, I designed and deployed it in a real environment, as you can see in the picture.
I think that should help you understand my point. Please check the webpage to get a quote, and you'll see that there are all the SKUs are available. By the way, VSLS is cheaper. Good look!!
Sorry this is not the correct interpretation of what @PhoneBoy has said.
-HA & -VSLS are both different to CPSB-VS-XX which is fine for Maestro use.
Physical appliances of a certain era had part number (SKU) variants that used to end with -HA suffix if they were to be used as a backup cluster member (these were offered with a discount).
Example: CPAP-SG5600-NGTP-HA which if you were to attach a Mobile Access blade to it would use CPSB-MOB-50-HA (not valid for Maestro due to the -HA).
As an example of the kind of license we mean, I have a pair of boxes running a small VSX environment. The first member has a CPSG-8C-NGTP license with a CPSB-VS-10 attached, resulting in this feature string in 'cplic print':
CPSG-C-8-U CPSB-FW CPSB-VPN CPSB-IA CPSB-SSLVPN-5 CPSB-ADNC CPSG-VSX-10S CPSB-IPS CPSB-URLF CPSB-APCL CPSB-AV CPSB-ABOT-L CPSB-ASPM CPSB-CTNT
The second member has a CPSG-8C-NGTP-HA license with a CPSB-VS-10-VSLS attached, and this feature string:
CPSG-C-8-U CPSB-FW-HA CPSB-VPN-HA CPSB-IA-HA CPSB-SSLVPN-5-HA CPSB-ADNC-HA CPSG-VSX-10S-HA CPSB-IPS-HA CPSB-URLF-HA CPSB-APCL-HA CPSB-AV-HA CPSB-ABOT-L-HA CPSB-ASPM-HA CPSB-CTNT
Note all the "-HA" suffixes and the "-VSLS" suffix on the VS-10. Those work for a traditional ClusterXL cluster, but they won't work for Maestro or ElasticXL.
I think I already see where the confusion is. You are right, and it was part of what I wanted clarified. The situation is that as of today, in 2026, HA/VSLS are the same license (attached).
However, there is a third SKU and it does not include the HA or VSLS suffix; that one would correspond to Maestro solutions.
I had assumed that HA and VSLS were separate, and that if the license did not have the VSLS suffix, then the remaining license corresponded to HA.
This assumption came from the fact that when you deploy a VSX Cluster, you can implement it without enabling VSLS. It would be good to understand why in older editions there were two types of licenses; nowadays they have already been unified.
Now everything makes sense: the Maestro license is more expensive (and it does not have any prefix).
However, I could say that in a traditional VSX Cluster the way you see this same SKU on the contracts page versus through CLISH is not the same. On the contracts page, you see the VSLS suffix (attached), but via CLISH you see the SKU as if you were looking at a Maestro license.
It is worth noting that via CLI the license has a slight change (CPSG-VSX-XS); instead of CPSB it shows CPSG, ending in “G” and I also saw that for this SKU it ends in "S", there was no more SKU associated in this VSX member, basically there was no any with CPSB-VSX-X-VSLS via clish as if it's visible in the contract web page for this client.
I am not an expert in licensing, but if there is something to clarify here, or perhaps something cosmetic that could be improved, that would be great. Thank you very much for your feedback. Additionally, I am including this old link from 2023, where the confusion is further explained.
Regards,
Avoid -HA and -VSLS for Maestro and all will be fine. 🙂
The rest is just differences in the friendly SKU you purchase vs how it translates on the backend.
I.e. CPSG vs CPSM just distinguish between a Gateway or Management license/blade.
Leaderboard
Epsum factorial non deposit quid pro quo hic escorol.
| User | Count |
|---|---|
| 33 | |
| 11 | |
| 10 | |
| 10 | |
| 9 | |
| 7 | |
| 7 | |
| 7 | |
| 6 | |
| 6 |
Tue 28 Apr 2026 @ 06:00 PM (IDT)
Under the Hood: Securing your GenAI-enabled Web Applications with Check Point WAFThu 30 Apr 2026 @ 03:00 PM (PDT)
Hillsboro, OR: Securing The AI Transformation and Exposure ManagementTue 28 Apr 2026 @ 06:00 PM (IDT)
Under the Hood: Securing your GenAI-enabled Web Applications with Check Point WAFTue 12 May 2026 @ 10:00 AM (CEST)
The Cloud Architects Series: Check Point Cloud Firewall delivered as a serviceThu 30 Apr 2026 @ 03:00 PM (PDT)
Hillsboro, OR: Securing The AI Transformation and Exposure ManagementAbout CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY