- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: Advice on installing replacement licenses to d...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Advice on installing replacement licenses to double the number of licensed CORES on a FW cluster
Hey everyone, hope you are all well.
Background for this query is we have a clustered Active/Passive pair of R0.30 firewalls currently Centrally managed for 4CPUs.
We have already been to CheckPoint and traded the 4 Core licenses in for replacement 8 Core licenses.
I now need to get round to adding the new licenses to the Manager and applying it cluster. I need to make sure the firewalls continue to process traffic when applying the new licenses.
I'm not clear whether any rebooting is required to get the firewalls to light up the new cores?
I am guessing that it will allow me to apply the 8 core licenses along side the 4 core licensed and then will just spawn some additional fw_workers straight away. I can then safely remove the old 4 core license?
But its only a guess!
Can anyone advise?
Many thanks
Tim
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Adding the eval license changes nothing.
I found Graceful failover with CoreXL mismatch after a CoreXL license upgrade .
Looks like state sync is possible like the same procedure for upgrades with "cphacu". That's new for me, but interesting that a change like you do could be done without interruption.
Wolfgang
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is indicated whenever a new license is applied and the number of licensed cores changes.
I don't believe it will impact traffic to apply the license.
However, I highly recommend performing this activity during a maintenance window.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
(PS. I feel like I'm talking to the God of CheckPoint! I've have been following your advise for years!)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@Tim_Spencer you lost your connections, because state synchronization between the nodes does not work if they have a different count of cores. You can change add the new licenses, change the cores and then reboot one by one. But be aware of the small gap.
Cluster will be failover but no state synchronization.
Wolfgang
PS: regarding @PhoneBoy , yes he's someone with a really great knowledge about all CheckPoint things, but in contrast to god he is a real awesome person 😉
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
PS. LOL
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Adding the eval license changes nothing.
I found Graceful failover with CoreXL mismatch after a CoreXL license upgrade .
Looks like state sync is possible like the same procedure for upgrades with "cphacu". That's new for me, but interesting that a change like you do could be done without interruption.
Wolfgang
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can uncheck "Drop Out of State TCP" on the Stateful Inspection screen of Global Properties to help blunt the effects of a non-stateful failover. Be sure to recheck the box when all done!
Exclusively at CPX 2025 Las Vegas Tuesday Feb 25th @ 1:00pm
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
