Cluster XL Licensing with Load Sharing

[mckenng]

Hello all,

My question is this, I have the following setup

6 pairs of Cluster XL Enforcement Modules using multicast load sharing

A Primary and Secondary Management Server

A single SmartConsole GUI client server.

When it comes to licensing I understand that I use the SMARTUpdate tool once the license is on the Management Server but what address do I license these to?

The shared address on each cluster? The reason I ask is the on the SMARTUpdate it shows each firewall and not an object for the cluster?

Any guidance would be appreciated.

[northlandboy]

All licenses should be central licenses, using the IP address of the primary management server. No-one (with half a clue) uses local licenses any more.

[EdinburghKev]

Northlandboy, can you expand a bit on what you say above. I am interested in knowing a bit more about why. My current role involves over 200 enforcement modules all licensed locally.

I will go off and read some info from the Check Point web site now as well.

[northlandboy]

Local licenses are the old method of licensing modules. I think it was around NG that they introduced central licensing. In Usercenter, when generating a new license, you just say that it is a central license, and you use the IP address of your management server (or probably your CMA IP address, since I suspect you're using P-1, with that many modules). You do this for all your modules' licenses. Effectively, all your licenses are then the same.

You then import the licenses into SmartUpdate, and attach them to the modules. No mucking around with fw putlic.

For initial setup, it probably doesn't make that much difference. Where it comes into its own is when you start moving modules around. Decommissioned one firewall, deploying a new one, with a different IP? No problem, just detach license from the old one, attach it to the new firewall. Need to move some of your feature strings around - e.g. you now need encryption on a module that wasn't previously licensed for it, but you have another firewall that has the license, but doesn't need it - no problem, just swap the licenses over. No need to go back into Usercenter and re-address licenses - which have limits on the number of times you can re-address them.

There's probably some other benefits somewhere, but those are the main ones.

[mckenng]

To just follow up on this now I have it all sorted now:

There were some more details I needed to add to my question:

The licenses were indeed all recorded centrally using the mgnt server ip address and attached to the enforecement modules as required using SmartUpdate, the other licenses I required for for the performance pack which were also recorded against the mgnt server (now all on provider-1...long story but they are now all migrated across)

Long and short all against the Mgnt server IP address, thanx for all the input.