I'm a little confused with VPN licensing for remote user connectivity. Before reaching out to support, thought I would ask here for some clarification.
We currently have a 2 gateway HA cluster consisting of 2 4600s and the virtual management node. We utilize Checkpoint Mobile for Windows for our office staff to use as there VPN client. These users are using IPSec VPN for remote user VPN connections. Mobile Access is NOT enabled on the cluster - only IPSecVPN is checked in cluster properties.
Now, we recently reached out to our vendor and stated we wanted to increase our concurrent VPN user capacity and they told us we needed to purchase a Mobile Access license CPSB-MOB-200. I told them we are not using Mobile Access (its not even enabled), but are using IPSecVPN. Regardless they said that's what is needed so we went ahead and purchased the MOB license.
This is what confuses me, if we don't currently use Mobile Access, but are just using IPSec VPN, then what are the Gateways using to determine how many concurrent users we can use? In my license files on the gateways I can see that each gateway has a CPSB-VPN , CPSB-SSLVPN-50 , and a CPSB-SSLVPN-5 license as a part of the license strings. There are NO CPSB-MOB licenses, which makes sense to me as we are not using. I guess it is using these SSLVPN licenses, but I cannot find data as to what these actually are? Maybe these are old license SKU's for mobility? Another point that has me confused, is we were operating under the assumption that we have always had licensing for 50 concurrent VPN users, but we have indeed gone past this limit and have had 70 users connect at one time.
To wrap up, these are my main question for our situation:
1. What licenses determine maximum concurrent IPSec VPN users?
2. Is a MOB license necessary if you are only using IPSec VPN?
3. What is CPSB-SSLVPN license?
4. How can I determine what my current VPN max concurrent capacity is? Is it possible the IPSec VPN allows unlimited?
.png "Wolfgang"){kind=avatar}
