What happens if licences expire on gateway

[carl_t]

Hi All

If our licence expires on our gateway and we are running IPS/Antibot/AV etc, what will happen?

Will it continue to run for 14 days?

Does it just stop scanning for these blades?

Will it impact any traffic, i.e stop forwarding through the gateway?

Many thanks

[the_rock]

Traffic wont stop, but you wont be able to push policy and blades wont get any new updates.

Andy

[PhoneBoy]

What you’re likely asking about is the “contract” which entitles use of annual blades.
There are specific SKs for:

• IPS: https://support.checkpoint.com/results/sk/sk4417
• App Control: https://support.checkpoint.com/results/sk/sk56300

In general, though:

• You will see errors when pushing policy with expired contracts and/or licenses
• Traffic will be passed if the access policy allows, but will not be inspected with the advanced blades that lack a current contract and is outside the grace period (if one exists). 
• If the base Firewall license expires (most of these licenses are perpetual), then no traffic will pass as the gateway will be enforcing “defaultFilter” which is to deny all traffic.

[the_rock]

I thought that traffic would NOT stop even if license expires. I recall couple times before it happened to the customer and everything sitll worked till they applied valid license the next day.

Andy

[Timothy_Hall · Accepted solution]

Gateway Perpetual Blades (Firewall, IPSec VPN, Mobile Access, Identity Awareness, QoS, ClusterXL, Monitoring, DLP) have a license that never expires; the only way these features would stop working is if someone manually removed the license or it became corrupt.

All remaining blades are Subscription Blades that require a service contract present to operate.   Once these features have 30 days or less left on their contracts prior to expiration, you will receive a warning every time you try to install policy to the gateway. There is no way to shut up this warning without loading a new contract.

Traditionally, Subscription Blades have had a 30-day grace period where they will keep working after expiration.  However in the latest Jumbo HFAs the grace period was extended to 90 days.  To my knowledge here is what will happen to the various subscription blades when they finally go beyond the 90 day grace period:

IPS - Continues enforcing Core Activations & Inspection Settings, but only enforces the "out of the box" ThreatCloud Protections.  Any updated/new ones stop being enforced.

APCL - Only custom-created applications still work, no classification for any other applications (would assume they are classed as "unknown")

URLF - Only custom-created Applications/Sites still work (no categorizations for any other sites)

Content Awareness - Not sure, would assume only custom-created Data/File types would work

Anti-spam & Email Security (which no one uses) - Don't know

AV/ABOT- I would assume they stop working completely, as they are constantly dependent on the Check Point ThreatCloud to operate

Threat Emulation/Extraction & Zero Phishing - Don't know, would assume that minimally cloud-based emulation sandboxing would stop working

[Timothy_Hall]

It appears the grace period for license expiration is in the process of being formally documented:

sk183922: [Under Construction] Grace Period for Check Point Software Blades

[rroihans]

404 not found

[the_rock]

Is that users get when they try to connect outbound?

Andy

[Tal_Paz-Fridman]

I can see it is still under construction and therefore marked as Internal.

[the_rock]

Geesh, sorry, you meant the sk...yes, I checked it, definitely not accessible yet.

Andy

[Timothy_Hall]

Well, it did say "[Under Construction]", so while it was there at one point, it must be hidden now until it is completed.

[PhoneBoy]

You're correct 🙂