Using 300 SecureClient users with only 100 licensed

[veto_]

Hi CPUG,

for a short time i got these messages at my SmartView Tracker:

- "PS: Your Policy Server license is limited to 100 users. Contact your reseller."
- "PS: less than 10 percent license free"

This is right, we bought years ago a license for 100 SecureClient users from a reseller, that said us, that it is for 100 concurrent user. So i was wondering as i have seen this messages at the first time. We have about 300 SecureClient Users now, but never 100 concurrent.
I could find out, that this information with concurrent users is wrong. But why did this messages appear not earlier. At the first time it has appeared, we had about 250 Users.

So my question is: What does this "100 Users" mean, if i can set up to 250 users and what license i have to buy now? Is the 250 user license enough or do i need a 500 user license.

And does anybody know, what happens if the license is finaly full?

Please excuse my gappy english.

regards

veto

[kva.kva]

IMHO
license for 100 users means 100 concurrent user;
for 250 users you can use license for 250 users (i saw this license in price);
if the license is finaly full that new user cannot connect to site.

[veto_]

now i have 2 statements against and 1 statement for "concurrent users". where do you have your inforomations from? Are you reseller?

And if it is really for concurrent users, why do i get this messages? I think at the "rush our" of remote users i have at most about 20 - 25 concurrent users.

[kva.kva]

Information about "conncurent users" from Check Point manager.
About your error, really i don't know (may be problem with smth like time-out of cashed connections?).

[veto_]

Check Point manager? Never heard from...?

[kva.kva]

Check Point's sale manager or Sale Manager from Check Point. (May be "sales", i don't know exactly). :)

[pdpita]

Officially SecureClient is licensed on a "per user" basis.
Check Point defines a user in this statement:

"User is defined as a computing device that is trying to traverse the firewall. For example, any IP address that is trying to pass through the firewall is counted. The IP address is counted even if it is blocked due to a specific rule configuration. Under the new User based license we are not differentiating between two users using a single machine i.e. a single IP address. In this scenario the two individuals will still be counted as one."

But more in detail I quote here under the official explanation of Check Point how the SecureClient licensing is working:

--------------------------------------------------------------------------
SecureClient license (CPVP-VSC-XXX-NG) is installed on SmartCenter management.
Prior to NG with Application Intelligence (R54), if the user group allowed to connect to a Policy Server (in SmartDashboard) contained more users than specified in the license, the administrator received a warning in SmartView tracker regarding a license violation.

Starting in NG with Application Intelligence (R54), the Policy Server counted unique user logins on a monthly basis, per Policy Server. If the number of unique users that logged on to the Policy server in one month exceeded the number specified in the license, the administrator received a license violation warning.

In NGX there is additional enforcement on the module, which counts the number of tunnels opened by remote users. A SecuRemote or SecureClient user can open only one VPN tunnel per gateway. For example, if the VPN-1 Pro license includes support for 1000 SecuRemote users, and in addition there is a license for 500 SecureClients, the 1501 user that attempts to open a tunnel to the gateway will not succeed.
--------------------------------------------------------------------------

This means that if each one of your 300 users will log in to the Policy Server at least once monthly, you have to buy a 300 users SecureClient license!

Ciao

[veto_]

Thank you, this is the information i need! :)

Do you know the name of the file, in which the users would be counted?

[kva.kva]

I found some information about SecureClients from my co-worker.
How many users do you use in group which is used in RemoteAccess (in RuleBase)?
SC counts number of users in this group and compare it with number from license.

[veto_]

i have 330 Users in this group.
and about 20 in an other group.

But the post from pdpita says, that this groupwise licensing is just at versions prior R54. At newer versions it will be licensed at users connecting per month. And i think this is the right solution for my problem.

Thank you.

[Steve]

Originally Posted by veto_

Thank you, this is the information i need! :)

Do you know the name of the file, in which the users would be counted?

did you find the name of this file, or how the users are counted? We are experiencing exactly the same thing.

Thanks.