SD-WAN licensing

[MikeB]

Hi Checkmates,

According to all quantum appliances datasheets, we can add SD-WAN as "optional" feature  with NGFW subscription services

but, licensing Instructions for SD-WAN in Product Catalog webpage indicates AppControl blade and URL Filtering blade are required in order to activate SD-WAN.

This creates a conflict since URL Filtering is not included with NGFW, so it would be mandatory to have NGTP or SNBT for SD-WAN to work??

[the_rock]

I would definitely verify this with Account services.

Andy

[PhoneBoy]

It's not strictly required.
However, steering traffic based on applications requires NGTP/SNBT.

[MikeB]

thank you for your answer @PhoneBoy , but why would it be necessary if you already have App Control with NGFW?? This little detail makes licensing unnecessarily complex and expense. If SD-WAN is optional for NGFW, it should include "all" of its functionalities and use cases, otherwise, it should not be offered for NGFW.

[Shlomi_Feldman · Accepted solution]

Hi Mike,

if the steering is made by services then you can have SDWAN on top of NGFW

if the steering is made by applications, then you need to have both Application Control and URL Filtering. in this case and as URLF is not part of NGFW, then you need to have SDWAN on top of NGTP or SNBT

[MikeB]

thanks for the clarification. It is clear to me that for SD-WAN to fully work, NGTP or SNBT is required.
It would be very interesting if Check Point could consider including URL Filtering along with the SD-WAN blade when you have NGFW, this way you could have a much more competitive offer and designed to cover other scenarios (for example when the customer already has a non check point perimeter security solution and is only interested in SD-WAN).