SecureXL license?

[SantiagoPlatero]

Hi all, quick question: does SecureXL need an specific license? 

I think when I have the gateway on R77.30 I've had SecureXL enabled, but in R80.10 when I issue a "# fwaccel stat", I have the following output:

Accelerator Status : no license for SecureXL

Also, CoreXL is enabled for 2 instances (as my open server license is only for two cores, the hardware have four) and I use the QoS feature (I remember some time ago where issues with QoS + CoreXL/SecureXL).

Thanks!

[Maarten_Sjouw]

The ACCL blade is indeed one of those pesky ones that was not included in all open server licenses, you really need to check which has the blade added. When the license only allows 2 cores, there will be no more then 2 cores working. QOS is also one of the things that need to be available in the SMS/MDS license, or you cannot create the QOS policy even.

[SantiagoPlatero]

Hi Maarten thanks for your answer!

Like you said the ACCL is a pesky one. As I recall like two/three years ago our Account Manager (not from Check Point, of the partner) told me the old ADN (Advanced Networking) changed to ADNC (Advanced Networking and Clustering). In the moment I didn't give major importance of this, but I believe now when I upgraded the gateway I lost this feature. Nevertheless, I didn't find documentation regarding from which blade/license is SecureXL tied to.

For now I tried to reissue the license from the UC, installed it and update the contracts from SmartUpdate. Installed then the database and finally installed policy on the conflicting gateway, but the situation remains. I've a pending reboot of the gateway as a last instance, but I don't think it will be any difference.

In the meanwhile I asked the partner to open a case to TAC, as for my support contract doesn't allow me to do it directly.

Also, if it's useful, in the conflicting gateway object, where it says SecureXL it has a blue "i" letter and a window pop ups telling "This feature is controlled from the gateway".

And also-also, in the UC the ACCL blade-related license appears like this: "CPSB-ADN - Advanced Networking and Clustering Blade now replaces Advanced Networking and Acceleration and Clustering Blades".

Thanks!

[G_W_Albrecht]

Looks like you have an old license version - output of "# cplic print" would show that in detail. This needs no TAC (technical) case as it is an CP Account Services issue, and tickets with AS can be made directly by the customer from every UserCenter Account !

[Maarten_Sjouw]

Well, that latter part <in the UC the ACCL blade-related license appears like this: "CPSB-ADN - Advanced Networking and Clustering Blade now replaces Advanced Networking and Acceleration and Clustering Blades"> is not quite true, I have some licenses with the ACCL blade and all others with the ADN blade, but only the ones with ACCL are able to enable SecureXL.

[G_W_Albrecht]

You should contact Account Services to get the ADN blade converted to ADNC - if that is impossible, you have to contact your CP sales partner and make a convert to ADNC order for 0$ ... 

[Maarten_Sjouw]

Günther,

I asked our sales guy here to take care of it but it was never done and they were quite reluctant to do so, I still have around 70 of those licenses in use.

[G_W_Albrecht]

As i already wrote, you could just involve Account Services yourself... I would not be reluctant to order something for 0 $$$ 😉

[SantiagoPlatero]

Hey all, thanks for the feedback!

But I would recommend, like Günther, not to order anything yet as appears to be an issue with Open Servers licensed for less cores than the hardware has (that's my case, I've four cores but only two licensed in this gateway).

More info: https://community.checkpoint.com/thread/10138-r8020-managing-r8010-gateway-cpu-increase#comment-3175... 

Although the license conversion (ADN to ADNC) would be an interesting test to make, I will try to do it as I've a pending conversation with our regional CP engineer about our current licensing.

Also, I didn't know that no matter the support contract we have, anyone with an UC account could open non-technical cases to TAC, is very good to know! 

Thanks guys!

[G_W_Albrecht]

No, not TAC cases - only Account Services regarding licenses and support issues without any technical background. Sometimes, it would get a TAC case after Account Services has confirmed that all licenses are correct 😉

[SantiagoPlatero · Accepted solution]

The right answer was gave by Ilya Yusupov‌ in this thread:

Ilya Yusupov escribió:

Hi,

After i digging into this issue i found out that for SXL you will need one the following sku's:

1. cpsb-adnc

2. cpsb-accl

:this is also written in ClusterXL admin guide

if i will find more documents that mention it i will share.

[SantiagoPlatero]

Quick follow-up: through our local partner we upgraded the old CPSB-ADN to CPSB-ADNC and now SecureXL is enabled and working, so hope this post works as a confirmation to the correct answer given by Ilya.

And for Maarten Sjouw‌ and Günther W. Albrecht‌, the upgrade wasn't for $0

But, on the other hand, it was only one license to upgrade so if you have many of them maybe you could negotiate some deal.