Is there any extra license required to enable and use Policy server/SCV?

[Blason_R]

Hi Team,

I have NGTP license with Office Mode VPN license for 50 users; wondering if I still need any other license to activate Policy Server and define Desktop Security Policy? Like EPM Suite? Or can existing licenses can suffice my need?

Thanks and Regards,

blason R

[Martin_Raska]

I think you are mixing a couple of things together. You don't need any additional license for SCV. The policy server is for endpoint solution when you need more servers to distribute packages, updates, and heartbeats. Desktop security policy is only for full endpoint clients with firewall blade enabled.

[Norbert_Bohusch]

I don't know a license for office mode VPN.
There is a license for MobileAccess (counting concurrent users) and one for Endpoint Security VPN (counting seas = real users).
Only Endpoint Security VPN officially allows Desktop Policy Server as far as I know.

[Blason_R]

I know Office mode VPN license does cover in Endpoint VPN license and I guess Policy Server is included as well. But wanted to ensure no extra licenses needed to activate it.

[Norbert_Bohusch]

Office Mode VPN is also allowed by Mobile Access license.
So if you have Mobile Access license and therefore can use Office Mode VPN, you will need a different license for Policy Server!

[Blason_R]

Yes, this is what I wanted to confirm as I wanted to activate Policy Server. Eventually, I wanted to enable compliance check for Endpoint Clients hence I believe I need to enable Policy Server then only I can activate SCV? Or Can I without Policy server?

[Norbert_Bohusch]

Technically the difference is not enforced, but from your license it is not allowed.

[G_W_Albrecht · Accepted solution]

Remote Access VPN Administration Guide R80.20:

Check Point clients that include Desktop Security, such as Endpoint Security VPN, enforce a Desktop Security Policy on the client to give it Firewall protection. The administrator defines the Desktop Security Policy in the Desktop Rule Base in SmartDashboard. You can assign rules to specified user groups or to all users.

If you use Endpoint Security VPN as part of the Check Point Endpoint Security Suite, you can configure if your client Firewall comes from Desktop Security in SmartDashboard or SmartEndpoint.

So if you have a license for Check Point RA clients that include Desktop Security (e.g. Office Mode VPN license for 50 users), you can use the GW as a Policy Server.

[Blason_R]

Okies!! In this case, I would not need to buy any other licenses and I can activate Policy Server with existing RA VPN Office Mode 50 User license.