License Question

[JoeBloggssss]

Hi,

I am trying to better understand Check Point licensing. To the best of my current understanding you are required to obtain a local license for the SMARTCenter server, and then you can also use its IP for all additional licenses for the enforcement modules. I have a few questions:

1. When you get a license for the SMARTCenter does it have to be local, I assume you have to include a license that covers the features SKU, do you all have to take into account the number of internal hosts, or is this only done on the enforcement modules.

2. I assume you apply a license to each enforcement module, can you apply more than one if the businss grows.

3. When taking into account internal client numbers to include in the license, what other facts impact this, I mean do external VPN clients need to be added to the number.

Any informationm notes, or links regarding this would be great. I understand that SMARTUpdate makes license management a gift, and a good reseller will address all these issues, I would just perfer a better understanding to the process. Thanks

 

[Akiwondo]

Hi,

Licensing can be quite difficuly to get a handle on....

SmartCenter Server I believe is a local licence containg the Managemnt Features. If you have Management + Enforcement on one Box then the features are part of one license.

There is something called Central Licensing in CP that means you can generate a license through the UsersCenter using your management's server's IP and then you can attach this to the Enforcement Module of your choice.

I think the Hosts licensing part is within the enforcement module part of the license, so if your management and your enforcement is on two separate boxes then then you license on the number of hosts (every host that is protected by the FW) behind the enforement module.

External VPN clients are not part of the "internal host" If you are talking about SecureRemote VPN Clients, you need to generate this as another license (Advanced Product or somthing like that in the UserCenter) and apply it to the enforcement modeule . SecureRemote license is free whereas SecureClient is a cost item.

If you buy another enforecement module, get another enforement module license with the appropriate features, hosts, VPN etc. It is recommnend that you use central licensing, generated within UserCentre. If want to move a license form one FW to another if you are using central licensing, detach it and attach using SmartUpdate.

If you are using Local licensing then you will have to generate a new license with the new local IP in UserCentre.

One thing to note also is if you want to manage you enforcements centrally - do not buy VIG (VPN Internet Gateways) as this includes a management feature within it (which you won't be using) and I'm pretty sure you can't use central licensing on these.

Hope this helps...

Akiwondo (MCSE, CCSE)

 

[JoeBloggssss]

Hi,

Thanks

This helps clear up any gaps in my understanding. I am sitting the CCSA next friday and just wanted to make sure I had all the facts, I did get a list of SKU codes used in licensing, but it is not the most simple of things to make sense of. Thanks for your help and time.

Chris McGill (CCNA, MCP)

 

[Akiwondo]

Good luck.



Akiwondo (MCSE, CCSE)