Maximum Mobile Users for 3100/3200 Appliance

[idhammer]

Hi all, anyone know the maximum concurrent mobile users (Mobile Remote Access Blade) for 3100/3200?

I have a client who is using 2205 appliance (maximum: 50 users) and want to add the license to 110.

Appreciate any help.

[PhoneBoy]

Depends on how much traffic each user is expected to transfer at once, not to mention other traffic the gateway is processing.

You should really discuss your detailed requirements with your local Check Point office or reseller so the appropriate solution can be spec'd.

[Luca_Martinis]

In terms of licensing the 3200 support CPSB-MOB-50 at maximum, that is 50 concurrent users. If you need to scale further the 5100 can have CPSB-MOB-200.

[Arsa]

Does it mean that lower model 1550 support 150 concurent mobile access users (100 included and 50 as additional software blade), and higher model 3200 can terminate only 55 mobile access users (5 included in the default package and 50 as Mobile Access extensions)?

[PhoneBoy]

There are license capabilities (what is being referred to here) and then there is what the appliance can realistically handle.

The SMB appliances do come with more Remote Access users (depends on model) and can be extended by another 50 users or so.
The amount you can extend it is, realistically, what those devices can handle.

Our non-SMB appliances only come with 5 Remote Access users.
If you want to do more than that, you can buy licenses to extend this (either Mobile Access or Endpoint depending on your specific requirements).
Mobile Access licenses come in three flavors: 50, 200, and Unlimited.

Obviously, no appliance will truly support "Unlimited" users as CPU and Bandwidth limits will come into play (internet bandwidth, bandwidth each user is using, access method, etc).
Under optimal conditions, a 3200 can support several hundred remote access users--more than the SMB appliances.

As I noted above, you should work with your local office or reseller to make sure the correct appliance is specified for your needs.

[Marcos_Vieira]

The 1500 (and even the 1400) series comes by default with more licenses than the 3100 or 3200 or even the 3600 but you must take into account that the SMB appliances do not support the SSL VPN Portal, which, as long as I know, consumes much more resources from the gateway than the conventional VPN Clients (SNX, Mobile for Windows). The only MAB license suggested in the price list to the 3000 series is the CPSB-MOB-50. I think it is because Check Point doesn´t know in advance what type of VPN the user will configure, so they are considering the worst case (SSL VPN Portal). If this is not the case, and you are going to use the SNX or Mobile for Windows, the license can be greater. 

[Marcos_Vieira]

Another important point here is that, according to the price list, the MAB licenses are not additive. So, if you need, for example, 100 users, you must buy the CPSB-MOB-200, and not 2 x CPSB-MOB-50.

PS: in the real world the rule above seems not to be applied. I would like to ask Check Point to change this rule and permit the licenses to be additive. It would avoid some headaches we have.

[PhoneBoy]

The MOB-50 is what is offered on the pricelist for the 3100/3200.
However, there is no actual restriction on using larger licenses that I am aware of, though you do have to keep in mind the performance limitations of those appliances.

Note that Endpoint licenses ARE, in fact, additive with MOB licenses.
Meaning you could buy SBA or even CPEP-ACCESS licenses (not listed in the Product Catalog, but orderable) and add them with your MOB licenses.
MOB licenses by themselves are not meant to be additive.