Questions about trial and standard licensing

[rodrigoteixeira]

Hello.

Does exist any kb or  other official documentation that list exactly what stops to work in Security Gateways and SmarConsole when we are using trial license and when we are using a default license.

Example:
For security gateway using trial license and it is expires, only basic firewall still works. IPS, Application Control, VPN IPSec, Remote Access stop work. And we can´t push new or change the policies.
For SmartConsole/management using trial licenses and it is expires, nothing works.

[_Val_]

It is very simple. Expect any unlicensed feature to fail. Even for FW, if GW is rebooted, the policy will be reversed to Initial. 

[PhoneBoy]

There are two things to worry about here: licenses and contracts.
Licenses can either expire or not, contracts always expire at some point. 
Most anything outside of Firewall, VPN, Mobile Access, and DLP have a contract associated with the service.
Perpetual features (Firewall, VPN, Mobile Access, DLP) will always function provided there is a valid license and it has not expired (i.e. not a trial license).
All other features will stop working after their contract has expired and all perpetual features will stop working (fail closed) if operating past expiration date. 
By "stop working" it means you will not be able to push policies that involve the features with an expired contract and any rules involving said features will not match.

For historical reasons, IPS is a bit different in this regard.
Generally, there is a grace period (60 days) and even after the grace period, a limited set of protections will still be active (all other protections will be inactive).
For the exact behavior, see: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[CheckPointerXL]

"Perpetual features (Firewall, VPN, Mobile Access, DLP) will always function provided there is a valid license and it has not expired (i.e. not a trial license)."

hey phoneboy, probably you mean valid contract, right ?

[Chris_Atkinson]

License is accurate in this context.

Note also that this has been simplified on the TP side for several versions now with a reduced reliance on the contracts piece.

Also in recent JHF takes there were amendments to  grace periods for some software blades. 

[the_rock]

Im 100% sure he meant license 🙂

[CheckPointerXL]

Something not clear to me

Let's say I add MOB license for 50users

This license is perpetual and it will work until a valid contract is attached. Am i wrong?

[the_rock]

I cant say for sure regarding specific licenses, but as Chris mentioned, there were some big changes in recent versions, so its less reliable on a contract itself. To be 100% positive, I would verify with Account Services.

[CheckPointerXL]

the changes that chris is talking about is related to other non-perpetual blades:

i'm now focusing on perpetual blades

[Chris_Atkinson]

Out of interest what's the scenario that you are in where you wouldn't be purchasing the support for the gateway/blades for this to be relevant?

[CheckPointerXL]

for the same reason Check point implemented the new changes 😄 

so, for example, let's say there is a problem with a renewal order, what happens to some perpetual features we are talking about?

i did the example with a MOB license.... people will continue to be able to connect after contract expiration? i don't think so, but honestly i never faced this problem

[the_rock]

If there is a problem with the renewal, I do what CP Sales engineers recommend...give customer full eval until renewal is sorted out. Issues solved 🙂

[Chris_Atkinson]

Subject to fair use Evaluation licenses are available via self-service for such scenarios as Andy says.

There are different options available here, all gateway blades versus dedicated mobile access etc.

Refer:

https://usercenter.checkpoint.com/ucapps/prodeval

[svori]

If a customer is failing to renew in time and Eval is used in meantime, what happens with support ?

Not possible until licenses are renewed or does it depend on function/blade ?

[Chris_Atkinson]

A discussion should be had with the customers Check Point account team to review options for gap coverage. Likely (subject to approval) they would be limited to phone support only until the renewal is processed. 

[the_rock]

As Chris said, best is to discuss with account team (or your local SE rep). I never had an issue where support was refused due to this, because lets be honest about it...no vendor in this world would want to lose any customer (no matter how big or small) for such a trivial reason.

[PhoneBoy]

Features that are perpetually licensed do not require a contract associated with them to function.

[IMCristian_Rosa]

Hello,

According to Checkpoint's SE, perpetual licenses, for example MOB, even when expired, will continue to work.

Does that make sense to you?

Att,

Cristian Rosa

[the_rock]

Last time I checked, word perpetual meant never ending, so to me, such license would never expire : - )

But, I could be wrong, would not be first OR last time lol

Andy