License warning messages

[the_rock]

Hey guys,

Honestly, this is probably not even priority 5 issue, but its really annoying and I cant for the life of me figure out how to solve it, so hope someone may have an idea : - ). So, the gist of it that old license was expiring January 28th and though I applied brand new eval (tried this twice actually), it still shows warnings about Jan 28th, though install database and policy work fine. I checked cp.pnp, even deleted that file, same issue.

Just to make sure, I issued cpstop/cpstart, rebooted, same problem. Its R81.20 lab, mgmt and single gateway. This issue ONLY affects management, not the firewall.

I attached 4 screenshots showing licences attached to it.

Cheers and thanks in advance for any help, as always!

[Chris_Atkinson]

Last time I saw something like this I used an NGSM specific eval rather than an all-in-one to resolve.

[the_rock]

Hey Chris,

Apologies for my ignorance, but if I lived 1000 years, I would never figure out CP licensing. How would I go about generating the license you mentioned? Happy to give it a shot.

[Chris_Atkinson]

Choose "Other" on the eval page then select from the Management section.

[G_W_Albrecht]

Management Only -

[Chris_Atkinson]

Yes choose the latter of those two.

Remove the previous eval.

[the_rock]

Thanks guys, I found it before it was mentioned here. Did apply it...do I need to do cpstop/cpstart or reboot or just wait patiently? : - )

[Chris_Atkinson]

Note unless removed/cleansed, the license with the nearest valid expiry date is always enforced until the rollover date. Newer evals don't just override them instantly. But seems multiple aren't attached here in the screenshots?

[the_rock]

Correct, there is only 1 I attached yesterday, expiring March 1st.

[the_rock]

Did that, even rebooted, same problem. I dont get it... : - )

[the_rock]

K, so just to clarify, here is what I tried so far,but exact same issue. As Guenter said, it is purely cosmetic, but I find it very odd, as R81.20 is the first version I have this problem, never before:

1) did sk suggested

2) rebooted both gw and mgmt

3) applied license you guys suggested and rebooted mgmt only

4) installed database and policy, rebooted both again

5) removed old all in one eval, rebooted mgmt only

6) installed policy and database, same problem

Andy

[G_W_Albrecht]

Looks like a cache issue - should work as expected and be only cosmetic, but you can try sk105757: Contract or license error: "Contract entitlement check failed"/ "Contract is expired"/ "Li... to make ECRS happy...

[the_rock]

Hey Guenther,

Thanks for that. I did actually do that sk right after I noticed the issue, but sadly, did not help.

Andy

[G_W_Albrecht]

As cplic print is correct this should be cosmetic only.

[_Val_]

What is "annoying" is that you complain about a cosmetic issue with EVAL licenses and that you cannot embed your screenshots so people can view them gracefully.  🙂 No worries, I will fix it for you in a moment.

It is normal to have a warning about the eval license which is about to expire. We expect you not to use a series of them in production, and if it is a lab, no need to complain either, in my book.

You could remove the "offending" license with cplic print del -x to fix it.

[G_W_Albrecht]

Second that - I think it is OK to try to fix it, but as this is not production (with picky customer) i would not waste much time as all is working as expected, except a warning in the very new SmartDashboard license view...

For customers i would have a certain debug plan including maintenance window to stop the nagging 😎

[the_rock]

I cant remove license thats nowhere to be found with cplic del -x command. If I run cplic print, it only shows one expiring March 1st, thats it. And no Val, Im NOT complaining, Im simply trying to fix something very simple :-). 

[PhoneBoy]

When applying new evals, cplic put -o is your friend.
It will erase all existing licenses and put the new one in.
Obviously do this with your management license, then add in the gateway licenses.

[the_rock]

Thanks phoneboy...ok, again, apologies for my ignorance about licensing, what is the best way to do it with that command? cpolic put -o and then the license string?

[PhoneBoy]

You are correct.

[the_rock]

Tried it and still same issue. It did actually overwrite the other license, but warnings are there regardless. Anyway, I will keep trying to fix it in my free time, Im sure its doable.

[the_rock]

K, did that...regenerated gw license too, pushed policy, installed database, rebooted both...no luck. I am positive at this point there has to be something thats "stuck" in the database that thinks this license that expired January 28 is still active. Im just not sure how to get rid of it. I even followed process from below link and same problem.

https://community.checkpoint.com/t5/Security-Gateways/License-about-to-expire-but-Expiration-Date-in...

Do these steps on the Security Management server:

1. Delete $CPDIR/database/EntMgr_DB.xml >> mv $CPDIR/database/EntMgr_DB.xml $CPDIR/database/EntMgr_DB.xml.org
2. Run: # psql_client monitoring postgres -c "DELETE FROM entitlement WHERE 1=1;"
3. cpstop;cpstart

The SQL command is to remove the stuck evaluation license from the MGMT database.

[PankajTiwari1]

why I am getting this error on ips blade. I have full license and it will expire in june 2024. I am getting this error on cluster gateway.

Please check the screenshot.

Host Expiration Features
trial 20Jun2023 PNP_BLADE_IPS:V1:trial CPSB-IPS
172.17.17.11 never CPAP-SG620X CPSB-FW CPSG-C-2-U CPSM-C-2 CPSB-VPN CP SB-SSLVPN-U CPSB-IA CPSB-SSLVPN-5 CPSB-ADNC CPSB-APCL-S1 CPSB-ABOT-S CPSB-CTNT C PSB-IPS-S1 CPSB-URLF CPSB-AV CPSB-ASPM CK-00-1C-7F-A9-07-19

[Tal_Paz-Fridman]

Probably because it does not calculate the total expiration and only looks at the older trial IPS license. 

I would remove it manually (CLI or from SmartConsole)

Also please look at https://support.checkpoint.com/results/sk/sk110082

Trial License will expire in "x" number of days

[_Val_ · Accepted solution]

IPS is not a permanent license, it is a contract software subscription-based, and it seems your subscription period for IPS is about to expire. 

In your license printout, it shows 1-year subscription:  CPSB-IPS-S1. Please look into this article for more details.

[PankajTiwari1]

yes, you are right. And it will expire on june 2024. My contract expiration for IPS is june 2024.

It will automatically updated when EVAL expire on 20jun 2023?

[PhoneBoy]

It should, yes.
If you want the error to go away now, remove the relevant license.

[the_rock]

On a side note, you can also do cplic put -o flag, which will overwrite an existing license. Learnt that from master @PhoneBoy , like lots of other things - : )

Andy

[the_rock · Accepted solution]

By the way, here is how to fix this issue in case anyone encounters it and none of the things we discussed here work.

Steps to do on the mgmt server:

1) cd $CPDIR/database

2) cp entitlement_status_collector_db.C entitlement_status_collector_db.C.backup

3) rm entitlement_status_collector_db.C 

4) reboot 

Once server is up, log in and all is green, done!

Cheers,

Andy

P.S. Thanks a bunch to @Jan_Jagos who pointed this worked on 1570 appliance in below link:

https://community.checkpoint.com/t5/Security-Gateways/License-about-to-expire-but-Expiration-Date-in...

[Uncle_Wally_SA]

Thanks this worked for me, it seems the reboot is not necessary though