Firewall and Content Awareness Blade missing license

[IZoom]

Hi all,

I have just activated eval lic all-in-one for checkup. I see Firewall and Content Awareness blades missing license.

>cpstat os -f licensing

Licensing table
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|ID |Blade name |Entitlement status|Expiration date|Expiration impact |Blade activation|Total quota|Used quota|
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
| 0|Firewall |Not Entitled | 4294967295|Firewall blade is not entitled. Access Control policy installation will fail (current policy will be kept).| 1| 0| 0|
|1001|Logging & Status |Entitled | 0| | 1| 0| 0|
|1000|Network Policy Management |Entitled | 0| | 1| 0| 0|
| 4|Application Control |Evaluation | 1619246913| | 1| 0| 0|
| 5|URL Filtering |Evaluation | 1619246913| | 1| 0| 0|
| 13|Content Awareness |Not Entitled | 4294967295|Content Awareness blade is deactivated. All policy rules using it will be affected | 1| 0| 0|
| 7|Anti-Bot |Evaluation | 1619246941| | 1| 0| 0|
| 3|Anti-Spam & Email Security|Evaluation | 1619248071| | 0| 0| 0|
| 6|Anti-Virus |Evaluation | 1619246941| | 1| 0| 0|
| 2|IPS |Evaluation | 1619246941| | 1| 0| 0|
| 10|Threat Extraction |Evaluation | 1621814400| | 1| 0| 0|
| 9|Threat Emulation Cloud |Evaluation | 1621814400| | 1| 0| 0|
|1003|SmartEvent |Evaluation | 1620542985| | 1| 6| 1|
| 1|IPSec VPN |Not Entitled | 4294967295| | 0| 0| 0|
| 8|Threat Emulation Local |Not Entitled | 4294967295| | 0| 0| 0|
| 11|Data Loss Prevention |Not Entitled | 4294967295| | 0| 0| 0|
|1002|Monitoring |Not Entitled | 4294967295| | 0| 0| 0|
|1005|Compliance |Not Entitled | 4294967295| | 0| 0| 0|
|2000|Mobile Access |Not Entitled | 4294967295| | 0| 0| 0|
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

> cplic print
Host Expiration Features
trial 24Apr2021 PNP_BLADE_ASPM:V1:trial CPSB-ASPM
trial 9May2021 PNP_BLADE_EVCR:V1:trial CPSB-EVCR-10 CPSB-SME-U
trial 24Apr2021 PNP_BLADE_IPS:V1:trial CPSB-IPS
trial 24Apr2021 PNP_BLADE_AV:V1:trial CPSB-AV
trial 24Apr2021 PNP_BLADE_ABOT:V1:trial CPSB-ABOT
trial 24Apr2021 PNP_BLADE_URLF:V1:trial CPSB-URLF
trial 24Apr2021 PNP_BLADE_APPI:V1:trial CPSB-APCL
127.0.0.1 24Apr2021 CPSM-C-U CPSB-NPM CPSB-EPM CPSB-LOGS CPSB-MNTR CPSB-PRVS CPSB-UDIR CPSB-WKFL-100 CPSB-WS CPSB-MPTL CPVP-SNX-U-NGX CPSB-SWB CPSB-ADNC-M CPSB-RPRT-U CPSB-EVCR-U CPSB-SSLVPN-MOBMAIL+5000 CPSB-COMP-150 CK-
127.0.0.1 24Apr2021 CPSG-C-8-U CPSB-FW CPSB-VPN CPSB-IPSA CPSB-DLP CPSB-SSLVPN-U CPSB-IA CPSB-ADNC CPSG-VSX-25S CPSB-SWB CPSB-IPS CPSB-AV CPSB-URLF CPSB-ASPM CPSB-APCL CPSB-ABOT CPSB-CTNT CK-

Any advice what's wrong here?

[PhoneBoy]

What version/JHF level?
The license looks correct.

[IZoom]

Hello,

thanks for come back. We are talking here about R81, fully updated. 

I found that when the license is removed, everything is green (with the default 14 days license after clean image). I have doubts it's can be related to management IP. I am preparing this box for generic purpose (checkup tests) -> there will be no static management IP. I have requested license for loopback adapter. I will test today/tomorrow if this is a root case why the blades does not accept license by assigning new evol lic.

I saw on forum, that license for any kind of assigned IP is OK for SMB. Is this valid as well for enterprise devices? 

[G_W_Albrecht · Accepted solution]

You need to use an IP of the SMS object - need not be the SMS head IP nor be used/enabled at all.

[IZoom]

Finnaly I test it. Thx guys. It could be better only when the blades will tell the real reason why they are not activated 😉

[PhoneBoy]

I missed that you used the loopback IP here, this is not supported.
Any other IP on the appliance should work. 
If you do a fresh install on a non-SMB appliance, there should be a 15-day PnP license included (i.e. no explicit license is required).
SMB appliances with recent firmware can take an All-in-One Eval license.