Licensing IP330 in redundancy

[pmoorey]

Hi,

I have two IP330's with CP NG FP3 running FW-1, IPSO 3.7.

I have configured VRRP between the two, and have installed enforcement module on one, and management and enforcement modules on the other.

I am having issues with licensing. As I am pushing policies from the management module to two firewall modules it fails because my license only supports one firewall in the management module.

The license I have are:

cpvp-vig-25-3des-ng cpvp-vps-1-ng fw1:5.0:dbvr_unlimit

Can I add a second license to the Nokia with the management module? or is there an alternative solution? I have additional licenses I can add to the management module FW...I don't wish to purchase a different type of license...

Hope someone can help!

[Robby Cauwerts]

Originally Posted by pmoorey

Hi,

I have two IP330's with CP NG FP3 running FW-1, IPSO 3.7.

I have configured VRRP between the two, and have installed enforcement module on one, and management and enforcement modules on the other.

You can't install the management server on one of the nokia's participating in the cluster.
Reinstall the Nokia with only the firewall module and get an additional server that will act as the management server.
You'll also need a failover license for the secondary Nokia firewall module.
(= cheaper than a standard license).

[mcnallym]

You have a VIG or Internet Gateway license. This only allows a install management and gateway on one box only, you cannot manage any other boxes with a VIG just itself.

You will need to upgrade this license to a VPN-1 Power or VPN-1 UTM Management and Gateway Bundle and then purchase a HA Gateway license. Match UTM or Power against the bundle you upgrade too.

For Power you will need to upgrade to at least R55 and for UTM then will need NGX R60 HFA02 or higher, R61.

I believe support for the 330's tapers out at R61.