Licence Entitlement

[m_k_user]

Hi Check Point team and community
Please, give me a clarification.
We have Check Point Security Gateway (Version: R81.10 Jumbo Hotfix Take 110), it is provided in the GCP. "cplic print" shows all licenses/blades are actual, but Maintenance->License Status show almost all licenses as "Available", and just few "Entitled". For example, "show security-gateway ips status" output is "IPS Blade is disabled".
Should the blades be activated somehow?
Or should the lacking blades be purchased via GCP market?
Maybe there was a licensing failure?

[Chris_Atkinson]

Could you please attach the output of the cplic print for review. Also what blades are activated in the corresponding gateway object settings in SmartConsole?

[m_k_user]

So, here are output and licenses from Smart Console.
And, sorry, I am frustrated with finding the blades switch on/off. Seems realy different from SMB hardware. They are in the Access Policy/ Rules, aren't they?

[Chris_Atkinson · Accepted solution]

The outputs suggest only the basic FW function has been activated.

For ease you can confirm this from the gateway cli by executing "enabled_blades"

The Threat Prevention admin guide for your version will provide further guidance on subsequent blade activation.

[m_k_user]

I know that Blades are not active - confirmation is excess.
As I understand I should create policy containing the required blades in the section "Threat Prevention" and then Install this policy (to the gateways). Right?

[G_W_Albrecht]

You can enable/disable TP blades in GW object and then publish the changes - policy changes are transmitted by policy install...

[the_rock]

Blades are turned off by using smart console fw object, unless you have one of those locally managed smb appliances, then you can do it through web UI.

As Chris said, based on the output, appears only fw blade is active. Honestly, just save yourself frustration, call Account services, give them your account number, explain the issue and Im positive they will be able to help you quick. If Im not mistaken, they are open M-F 7 am to 7 pm CST. (GMT-6)

Andy

[the_rock]

I think if you call Account services, they can sort this out quickly. But as @Chris_Atkinson said, if you send cplic print -x output, we might be able to confirm.

Andy