License to Internal Interface

[avilT]

Hi,
Is it possible to bind the checkpoint license to internal interface? Right now I have it bound to external interface. Due to movement the public IP will change. So is it possible to bind the new license to internal interface so that in future movement I need not worry about the license.
Thanks
Av

[northlandboy]

Is this a standalone combined management/enforcement point? If it is, then yes, you can license it to any IP address that is valid on the system.

If you've got separate management and enforcement, then use central licensing, and license to the mgmt IP.

[avilT]

Its Checkpoint NG FP3 on Nokia IP330 and management/Log server on Windows 2000 Server. Can I bind the license to the internal interface?
Thanks

[RayPesek]

You do not want to do that. You get a "central" license for the Nokia box. It will show the IP of the SmartCenter. You then use SmartUpdate to "attach" the license to the Nokia (which should be set up in the SmartCenter using its external IP address).

If you need to change the external IP of the Nokia, you use SmartUpdate to "detach" the license, make your IP changes and "attach" it to the Nokia again. With central licensing, there is no Check Point involvement needed to change external IP addresses.

Ray

[avilT]

Thank you once again. Does it mean that
1. If you are installing license on Nokia module (Local License) License must be bind to the external interface of the firewall.
2. With Smartupdate (central license) the license can be bound to the management IP of the Nokia module.

Thank you very much

[RayPesek]

You should license the external IP address.

Central licenses, regardless of the product or function, are issued to the IP address of the SmartCenter and then assigned (attached) to the modules as needed. This makes the IP address of the module itself irrelevant. You never need to re-license anything through Check Point as long as the SmartCenter IP address does not change.

HTH,

Ray

[avilT]

That means, in the case of Central Licensing, if I issue cplic print command on the fw module what IP it should display? firewall manager IP?
Also is Central Licensing requires additional cost?
Thank You

[RayPesek]

I don't know what the command line will show, however the central licensing option is free and the preferred method.

Ray