Inject license failed, on some blade security gateway

[Adity12]

Hi All,

Have a good day,

My customer has a problem with the license security gateway update.

When they inject that license with smart updates, some blades are updated for up to a year but there are two blades: anti-bot and anti-virus.

The blade does not use the new license but still uses the old license.

I was also to try to inject again but the problem still appears.

In my lab I also had the same problem with my customer but I solved this problem by manually injecting the gateway.

i use cplic put command, but for this command should i reboot the gateway or not? if i reboot the gateway will update for new license.

the following is attachment for capture result of injection license.

Thanks Regards

Dio Aditya Pradana

[the_rock]

You only need to do the reboot if it says number of cores had changed, otherwise, no.

Andy

[Adity12]

@the_rock nice answer

does you know, what root of this issue? or maybe gateway can't use that license on some blade or there is another issue.

Like bug maybe. CMIIW

Thanks Regards

Dio Aditya P

[the_rock]

If the actual license covers those blades, then remove any trial licences.

[Tal_Paz-Fridman]

Hi

Can you share the output of cpstat os -f licensing from the Security Gateway?

Thanks

[Adity12]

Hi @Tal_Paz-Fridman 

Thanks for your suggestion, i will check it first.

Thanks Regards

Dio Aditya P

[G_W_Albrecht]

Also check cplic print to see if another AV / AB license is active still ! And look if you also can see the correct service date on the new license.

[Adity12]

Hi @G_W_Albrecht 

Here the result of command cplic print.

Service date has successfull use new license for all license, include AV and AB

Thanks

[G_W_Albrecht]

Services look OK - but what about the license itself, is it only one for one appliance ?

Also found this - sk105057: Enterprise Based Protections (EBP) contract not taking effect

as you use EBP.

[Adity12]

Yes, each appliance has a each self license, so there is two different license for FW_1 and FW_2.

The difference is the second appliance on cluter use HA on the name license.

[G_W_Albrecht]

You should be able to see the older license.

[Adity12]

Yes, I found that license has expiry day until April 26, 2022

[G_W_Albrecht]

If you want to remove it, use cplic print -x to see the license signature you use in

cplic del axxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

to remove it. Or, just wait 8) !

[Adity12]

Hi @Tal_Paz-Fridman 

The following attachment is result from cpstat os -f licensing from 2 gateway.

FYI: only 2 blade can't renew license.

[Adity12 · Accepted solution]

Hi All,

Thanks for your advice and support, this case has been resolved.

Yesterday i held session with my customer and checkpoint support.

Here is the summary of session, i think it will be useful for who has same issue like my customer.

• Anti-Bot/Anti-Virus : About to expire (26/04/2022)
• cplic print shows parament license 
• cpstat os -f licensing : Entitled with correct date.
• Install database, no luck
• contract_util mgmt no luck
• try to check on database psql on management server
• verify there is a old license still used by blade
• delete old license from psql database
• Disable the blades, pushed the policy
• Enabled the blades, pushed the policy
• Issue resolved

Thanks Regards

Dio Aditya Pradana

[the_rock]

Tx for the update...just curious, when you say "

• delete old license from psql database

What exactly are you referring to? Was there a file you guys had to remove?

Andy

[Adity12]

yes, because when we checking database on management server and use command psql_client monitoring postgres to open monitoring database and using command select * entitlement where blade_name='Anti-Virus' and entitlement status='Entitled';  and the result is there is 4 list license 2 will expire on 26 april 2022 and other will expire 26 april 2023. ( the old licensing still using)