1)
License Guide 2) "Central licensing stores all licenses in a license repository on the
SmartCenter Server. Licenses are installed to the machine they are
assigned to via SmartUpdate. Licenses are not tied to the IP address of the system they are installed on, and can be reassigned to resources as necessary."
There is no need to generate new licenses when Security Gateway IP addresses change. There is no need to use public IP for a SC. Using private IP for SC is a common situation.
3) You need one license for mds and license for each cma.