R77.30 Evaluation Licensing Keep Getting Assigned Local License Type

[alfreska]

Our hardware firewall failed at one of our sites and a new one is on the way, and in the meantime I am trying to deploy a VMWare version of R77.30. Our CheckPoint infrastructure is centrally managed with a SmartCentre management server.

I generate an evaluation and select the "CENTRAL" Licensing Option and then enter the IP Address of the SmartCentre Server. When I finally get the license and try to install it, SmartUpdate will complain that there is a MAC Address or IP Address Mismatch. If I try to install it on the Smart Centre's Console using "cp lic" command, it will install but it will get attached to the SmartCentre Server Object! Upon double clicking it will say "local" instead of "central".

Next I try to generate one just for the temporary gateway's IP, and use cp lic on it to attach it directly on that gateway's console. It does attach, but when I go to push the policy, it says something like Load on module failed - you do not have the adequate license, even though the IP Matches one of the interfaces, and I even set that IP to the main IP on the Gateway Object in Smart Center.

I remember in the past, about 2 years ago, I was able to generate a Central Based Eval, import that into SmartUpdate, and then assign it to my gateway. Has the licensing rules changed since then or is there a bug on the site that causes it to not generate central licenses any more? This is really annoying!

Thanks for any assistance.

[Timothy_Hall]

What IP address for the SMS is being displayed in SmartUpdate? (not SmartConsole)  That is the IP you need to bind to an All-in-one license (see screenshot) using the default central licensing, then import it into SmartUpdate.  Another gateway-based license will now be present in the repository, and you can attach that to a gateway with any IP address defined locally, as long as that gateway is managed by that same SMS and SIC is established.  The licensing procedure has not changed from what you are describing, it sounds like you are generating it against the wrong SMS IP address or have the wrong kind of license.

[Maarten_Sjouw]

When you attach a local license on the gateway, you need to do a get licenses from SmartUpdate to make sure that also the Management server is aware of that license.

[alfreska]

I generated an all in one license using the IP Address shown next to the SmartCenter Management Server when I open Smart Update using Central Licensing on the generation webpage. It then presents me with a license file which I downloaded and then imported using Smart Update. After importing, the license attaches to the SmartCentre Management Server itself, instead of appearing in the repository. If I double click it, the license shows up as 'local'. I then detach the license from the SMS, and it shows in the repository. I then attach it to the Firewall successfully. Then I did a "Get All Licenses" and try to push a policy and get:

"The following errors and warnings exist: No sufficient licenses installed for Security Gateways with Monitoring Blade.(BR)If you do not intend to use SmartView Monitor, please uncheck this product from your Security Gateway(s)
"
SMS IP as shown in Smart Update: 209.x.x.149
FW IP as shown in Smart Update: 209.x.x.148
Generated-License-Central-IP: 209.x.x.149

Am I missing something?

[Maarten_Sjouw · Accepted solution]

Ok I see where your confusion comes from, the license file contains 2 licenses, one for management (starts with CPSM) which is attached to the management server as a local license, when you look in the repository, you will find the CPSG license that you can attach to your gateway. This is a manual job, right click on the gateway in SmartUpdate and choose attach, then you will see the available licenses to be attached.

[alfreska]

Thanks Maarten, that worked!