Virtual Systems package License question

[Scottc98]

Hello everyone,

Hoping someone can help me understand the differences and use cases for the Virtual System packages in the product catalog.

In general, I see two different types:

• CPSB-VS-X  ("X" Virtual Systems package)
• CPSB-VS-X-VSLS   ("X" Virtual Systems package for HA/VSLS)

For the "X", there are package options for 3, 10, 25 and 50 VSs 

My question is when is each license type used?   

I assume that if I want to stand up a single hardware device (Say 7000 GW for example) as a VSX gateway, I would order the first line item to meet the # of VSs required (and what fits the compute capacity).

What if you are doing a VSX cluster (2 6600 nodes for example)?    Is that where the CPSB-VS-X-VSLS package is used instead?  If so, is it ordered as one SKU item that is shared among the cluster (2 7000 Gws and any future ones if expanding horizontally).   Or is is still one per GW regardless?

There seems to be a general MSRP price difference in the catalog as well so really trying to understand each here.  

Thanks in advance

[Chris_Atkinson]

Ttraditionally (for 2016 series and earlier gateway appliances) the primary/first node of a cluster carries the non VSLS license package.

Then the -VSLS variant is only used on subsequent members of a cluster being nodes 2 or 3 etc.

Each cluster member requires it's own license.

The licenses are stackable (per-node) with exception of the smallest increment.

[Scottc98]

Thanks @Chris_Atkinson for the response.   Let me see if I understand this right:

  Using a 4 node VSX cluster for 4 VSs  as an example, would it be fair to say we could deploy with these two possible license situations:

Option  1:

node 1 (Primary) has a CPSB-VS-5 license and nodes 2, 3 , & 4 all each need a  CPSB-VS-5-VSLS license.

Option  2:

node 1 (Primary) has a CPSB-VS-5 license and nodes 2, 3 , & 4  also have their own CPSB-VS-5 license

Option 1 licensing truly ties 3 of the members to only run in a VSLS cluster; with node 1 being able to run in a VSLS or as a single standalone VSX gateway.

Option 2 licensing provides all 4 gateways with options to be single VSX gateways or in a VSX/VSLS cluster; providing more options with the licenses in their deployment possibilities....but with a little higher cost 😉

Is that an accurate assessment or am I off?

[Chris_Atkinson · Accepted solution]

Pretty much nailed it though I believe with the current generation hardware the VSLS SKU option is no longer relevant / presented in the product catalogue from memory. Also there isn't a 5 gateway license increment as such.

[Scottc98]

Thank you @Chris_Atkinson .   Duly noted on the lack of 5 VS package.....my failed attempt for an example breakdown.  Should have just said '10' 😉

The VSLS SKU was something I was not aware of being 'legacy' but that would make sense on why the non-vsls license was recommended to us from our account team.     Can't blame a customer for asking....especially when VSLS was cheaper 😉

thanks again.  

[PhoneBoy]

Each gateway needs the relevant licenses.
VS licenses are used on the first member of your VSX cluster.
VSLS licenses can be used on the other members of the VSX cluster.
Note that VSLS licenses cannot be used on their own (i.e. it must be paired with a node that is using regular VS licenses).
This also means VSLS licenses cannot be used on Maestro.

VS/VSLS licenses for 10 VSes and above are stackable on a gateway (meaning, you can purchase multiple of them as needed).
VS-3 licenses are not stackable and must be traded in to a VS-10 or higher.

[yongfu]

Hi, 

also to check for virtual switch/virtual routers that are not counted as VS License, will they need to be accounted for management server license ? 
example for a management server of 5 gateways, with a single firewall of 10VS license, can the management server manages 5VS( with include of VS0) + 1 virtual switch? (Understand that VS0 is not counted for management license) 

thank you 

regards 

[Chris_Atkinson]

Virtual Switches/Routers are not counted.

VSX Management licensing is outlined in sk119075.

[Bob_Zimmerman]

On older versions, routers definitely consumed a VS slot. Any idea when that changed?

[Henrik_Noerr1]

how are other blade licenses done in regards to Virtual Systems?

Let's say I need IPS. So I need CPSB-IPS-X2L and CPSB-IPS-X2L-HA (for a large appliance)

Are all Virtual Systems licensed with IPS if I buy these for 'VS0' - or would each individual IPS enabled VS need this license.

Thanks,

Henrik

[Chris_Atkinson]

VS is covered by whichever blades the appliance is licensed for.

[Henrik_Noerr1]

Thank you - We have been running on a EBP-NGTP free for all, so did not have to think about it.

This may continue, but I see that we pay for the privilege. Not having an EBP license hurts flexibility of course.

Appliance support can be renewed with CPSB-NGFW-XXX bundle - but links describing license features link to generic https://www.checkpoint.com/products/ page. The description is high level at: "Check Point Next Generation Firewall Gateway Blades Package (including IPS blades and Application Control)" - Or maybe it is exactly this? 🙂

That would mean adding CPSB-ADNC for normal clusterxl and securexl and CPSB-VPN for ipsec (s2s)? or are these included in CPSB-NGFW?

Maybe I am missing an obvious blade license, not sure. 

Thanks

[Chris_Atkinson]

The last page of this document should help:

https://www.checkpoint.com/downloads/products/check-point-appliance-comparison-chart.pdf