Endpoint Security Licenses

In This Section: Endpoint Security Product Licenses Demo and Temporary Licenses License Enforcement Getting Licenses Getting and Applying Contracts License Status

This chapter includes license information for Endpoint Security Servers and Clients. All Endpoint Security licenses are physically installed on the Endpoint Security Management Server.

Endpoint Security Product Licenses

This section describes the required Product licenses for Endpoint Security.

License Type	Explanation
Software Blade licenses	One license for each Endpoint Security Software Blade installed on an endpoint client (seat). The blade licenses include: Full Disk Encryption Media Encryption & Port Protection Anti-Malware Network Protection - Bundle license that includes Endpoint Security Firewall, Compliance, Application Control, and Access Zones. This license automatically comes with the Container License.
Management license	A license for each Endpoint Security management server. The management license also includes these management blades: Management Logging & Status User Directory
VPN License	A license for the VPN gateway that endpoint users connect to. You Install this license on the Security Management Server that manages VPN gateways. Do NOT install a VPN license on the Endpoint Security Management Server.

Demo and Temporary Licenses

These demo and trial Endpoint Security licenses are available:

License type	Explanation
Demo License	A 15 day demo license is automatically installed with Check Point network security products. This license lets you use Security Gateways, the Security Management Server and all SmartConsole applications.
Trial License	A 30 day trial license is automatically installed when you install Endpoint Security. This license lets you use all Endpoint Security Blades for a limited number of endpoint client seats.
Evaluation	An evaluation license is available for specified software blades for a specified number of seats.
Product	You must purchase a Product license for each Endpoint Security Software Blade running on a client. Licenses can be purchased as a Subscription, a contract that is renewed annually, or a one-time purchase.

License Enforcement

License activity conforms to these conditions:

• You can add Endpoint Security licenses as required using one of these methods:
  • SmartUpdate
  • The Gaia Portal
  • The cplic CLI command
  • The cpconfig command for Windows platforms
• You can remove a client license by resetting the client or deleting the client using SmartEndpoint. These licenses are returned to the license pool.
• Each client gets its Container and Blade licenses from a pool of available licenses.
• You can combine licenses to reach the total number of required clients.
• License validation occurs when the client sends a SYNC or heartbeat messages to the server.
• When there is no container license, software blade registration is blocked (R77 Management only)

Getting Licenses

This procedure assumes that you have a user account for the Check Point User Center, and that the necessary licenses and contracts are purchased.

To get the license for your Endpoint Security Management Server:

1. Log in to Check Point User Center.
2. Click My Products > My Products Center.

   The page shows the purchased licenses.

   Endpoint Security licenses have these parts in the SKU:

   • CPEP - Check Point Endpoint Security containers.
   • CPSB - Check Point Software Blade. If the macro string includes the -SUBSCR suffix, you must get and apply a contract for this feature.
3. For each license:
   1. Click the license to open it.
   2. In the window that opens, click License.
4. Fill in the form that opens.
   • Make sure that Version is R80 and above.
   • Make sure that the IP Address is the IP address of the Endpoint Security Management Server.
5. Click License.

   A window opens, showing the license data.

6. Save the license file.
7. Add your licenses using one of these methods:
   • SmartUpdate
   • The Gaia Portal
   • The cplic CLI command
   • The cpconfig command for Windows platforms

Getting and Applying Contracts

If the license includes -SUBSCR, you must download the contract file and apply it to the server. If the Endpoint Security Management Server has Internet access, it automatically renews contracts. By default, the Endpoint Security Management Server looks for new contracts every two hours.

To change the default time interval:

1. Open this file:

   $CPDIR/conf/downloads/dl_prof_CNTRCTMNGR.xml

2. Change the <interval> value as necessary.
3. Run cpstop and cpstart.

To apply a contract manually:

1. Log in to Check Point User Center.
2. Click Products.
3. Select Get Contracts File in the drop-down menu at the right of the row.
4. In the window that opens, save the contract file and click Open.
5. Open SmartUpdate. (Start menu > Check Point > SmartUpdate)
6. Select License & Contracts > Updated Contracts > From File.
7. In the window that opens, browse to where you saved the contract file and click Open.

   The contract is applied to the Endpoint Security Management Server.

If the Endpoint Security Management Server does not have access to the Internet, prepare the contract file download from the User Center differently.

To download a contract to a different computer:

1. In the User Center, click Products > Additional Services.
2. Select the account of the contract.
3. Click Email File or Download Now.
4. When you have the contract file, move it to the Endpoint Security Management Server.

Configuring a Proxy for Internet Access

If the Endpoint Security Management Server requires a proxy to connect to the internet, configure the proxy details in SmartConsole.

To configure a proxy for the Endpoint Security Management Server:

1. In SmartConsole, open the Endpoint Security Management Server object.
2. Select Network Management > Proxy.
3. Select Use custom proxy settings for this network object.
4. Select Use proxy server and enter the URL and port.
5. Click OK.
6. Install Database.

License Status

You can see the status of container and blade licenses in Endpoint Security Management Server on the Reporting tab > Licenses Report. This pane shows the total number of seats and seats in use. If the number of seats exceeds the number of licenses, you must add the number of licenses shown as Insufficient Seats.

The lower section of the report shows the details of each license including:

• License Name and status
• Software Blades
• Seats in Use
• Total seats
• Percentage of total licenses in use
• Expiration date
• IP address of license host