Checkpoint Gateway don't receive license

[TronNQ]

when I show cpstat os -f licensing and notice that on our Gateway device it doesn't show any blades.

Has anyone had this problem before?

[AkosBakos]

Hi TronNQ,

Have you licensed the appliances in the usercenter?

Have you tried to put the licences manually? Eg.: #cplic put, or using the SmartUpdate?

If you do it manually, don't forget update the contract files too. You can download it from the usercenter. 

And one more, the appliances have "real" internet access? Can you ping updates.checkpoint.com?

A

[TronNQ]

Dear Akos,

Yes, I have add license Manually, currently gateway device and managent device already expried license, i have install license EVAL, but management device have recieve EVAL license, but Gateway show like this.

Gateway device can ping updates.checkpoint.com

[the_rock]

Please provide output of cplic print -x. Also, once you open smart update, make sure to right click on the object and then click "get licenses"

Below is example from my R81.20 lab

Andy

[Expert@quantum-firewall:0]# cplic print -x
Host Expiration Signature Features
172.16.10.205 3Jul2023 dLmx6j4auSnftt8Wgi4m8udjLSZJwc4Cywhz CPSG-C-8-U CPSB-FW CPSB-VPN CPSB-IPSA CPSB-DLP CPSB-SSLVPN-U CPSB-IA CPSB-ADNC CPSG-VSX-25S CPSB-SWB CPSB-IPS CPSB-AV CPSB-URLF CPSB-ASPM CPSB-APCL CPSB-ABOT CPSB-CTNT CK-628D753A9280

Contract Coverage:

# ID Expiration SKU
===+===========+============+====================
1 | MUVY3AG | 2Aug2023 | CPSB-IPS-EVAL
+-----------+------------+--------------------
|Covers: CPSG-C-8-U CPSB-FW CPSB-VPN CPSB-IPSA CPSB-DLP CPSB-SSLVPN-U CPSB-IA CPSB-ADNC CPSG-VSX-25S CPSB-SWB CPSB-IPS CPSB-AV CPSB-URLF CPSB-ASPM CPSB-APCL CPSB-ABOT CPSB-CTNT CK-628D753A9280
===+===========+============+====================
2 | 3AENF43 | 2Aug2023 | CPSB-TEX-EVAL
+-----------+------------+--------------------
|Covers: CPSG-C-8-U CPSB-FW CPSB-VPN CPSB-IPSA CPSB-DLP CPSB-SSLVPN-U CPSB-IA CPSB-ADNC CPSG-VSX-25S CPSB-SWB CPSB-IPS CPSB-AV CPSB-URLF CPSB-ASPM CPSB-APCL CPSB-ABOT CPSB-CTNT CK-628D753A9280
===+===========+============+====================
3 | MK7CO0K | 2Aug2023 | CPSB-TE-EVAL
+-----------+------------+--------------------
|Covers: CPSG-C-8-U CPSB-FW CPSB-VPN CPSB-IPSA CPSB-DLP CPSB-SSLVPN-U CPSB-IA CPSB-ADNC CPSG-VSX-25S CPSB-SWB CPSB-IPS CPSB-AV CPSB-URLF CPSB-ASPM CPSB-APCL CPSB-ABOT CPSB-CTNT CK-628D753A9280
===+===========+============+====================
4 | 69YUEAO | 2Aug2023 | CPSB-CTNT-EVAL
+-----------+------------+--------------------
|Covers: CPSG-C-8-U CPSB-FW CPSB-VPN CPSB-IPSA CPSB-DLP CPSB-SSLVPN-U CPSB-IA CPSB-ADNC CPSG-VSX-25S CPSB-SWB CPSB-IPS CPSB-AV CPSB-URLF CPSB-ASPM CPSB-APCL CPSB-ABOT CPSB-CTNT CK-628D753A9280
===+===========+============+====================
[Expert@quantum-firewall:0]#

 

 

Hope that helps.

[TronNQ]

Hi Bro,

This is out put cplic print -x of me, device expried license at 5may2023, if correct it will show expried at 7Jul2023 after I import license EVAL.

I think, because license table don't show blade as metinon from previous chat.

[TronNQ]

even on device's webui doesn't show any information?

[the_rock]

Message me offline, I can generate one for you, just send the IP address.

Cheers.

[the_rock]

I messaged you directly with proper string...just apply exactly what I sent you from expert mode and then do get licenses from smart update and let us know.

[TronNQ]

Thanks bro, i will try and let you know!

[the_rock]

You can also do it with -o flag, BUT, that would overwrite any existing licenses, so be careful if you do that.

Andy

[Expert@quantum-firewall:0]# cplic put
Install license on local machine:
cplic put [-o overwrite] [-c check-only] [-s select] [-F <output file>] [-P pre-boot] [-k kernel-only] < -l license-file | host expiration-date signature SKU/features >

[Expert@quantum-firewall:0]#

[the_rock]

For you bro, no charge, except Iphone charge ; - )

[the_rock]

Hey @TronNQ , any luck with what I sent you?

Cheers mate.

Andy

[TronNQ]

Hi Bro,

I have tried, but it dosen't work. it still show expried date at 5May2023.

[TronNQ]

i think the problem is probably because in os does not contain any license, cpstat os -f policy.

[the_rock]

Honestly,  I would reach out to TAC and have them verify. Something does not look quite right.

Andy

https://help.checkpoint.com

[TronNQ]

Because, the license have expried, I don't know if it is possible to open the case with TAC with this condition?

[the_rock]

That I could not say, you can try open one online or call them and they will verify.

Andy

[Blason_R]

Did you try to cut the licenses from your usercenter with central license and imported into Smart update and then tried attaching?

If so then contacting license support would really help as @the_rock suggested. 

[the_rock]

Im thinking maybe Account services would be best to help here.

Andy