R60 HFA 04 Remote Access Users Licensing Change [FYI]

[melipla]

In case anyone missed the line about changing user licenses into IP licenses, read on...

It appears that ever since I upgraded to HFA 04 I am now seeing licensing errors in my logviewer:

PS: Policy Server license is 90 percent of limit (Windows license is limited to #### users).
PS: Policy Server license is 90 percent of limit (Windows license is limited to #### users).
PS: Policy Server license is 90 percent of limit (Windows license is limited to #### users).
PS: Policy Server license is 90 percent of limit (Windows license is limited to #### users).
PS: Policy Server license is 90 percent of limit (Windows license is limited to #### users).
PS: Policy Server license limit exceeded (Windows license is limited to #### users).

The official response I received from Check Point is this:

"I've been told that the way the new licenses work with NGX is that the firewall keeps track of the IP's that login with SecureClient for 28 days. If there are more than #### users that login to SecureClient during a 28 day period, or if one user logs in from different computers, or if their ISP gives them a new IP every time they log in, this would add to the number of SecureClient logins that the firewall sees."

Before this HFA I was running at about 50-70% license usage. Now I'm exceeding the license limit multiple times a day. The real kicker is that as far as I know there's no way to check the number of licenses that CP thinks you are using--the number from SmartView Monitor is not accurate.

[kva.kva]

Old thread about this - Using 300 SecureClient users with only 100 licensed

And "dtps lic" show number of licensed users.

[kva.kva]

Also, I think, that information about SecureClient users is kept in two files.
For SPLAT - /opt/CPsuite-Rxx/fw1/policy/local.psd and /var/opt/CPsuite-Rxx/fw1/state/local/PS/local.psd.
May be first file for "global" properties (information from license) and second for current connections.