Troubleshooting guide

Chapter 11 Troubleshooting Licensing Check Point Licensing Policy
Advanced Technical Reference Guide 4.1 • June 2000 120
FireWall-1 and VPN-1 licenses are based on the total number of protected nodes. This requirement does not
change when using any intermediate proxy or device capable of IP address translation.
For the network shown in the diagram above, the VPN-1/FireWall-1 license must support all "n+1" internal
nodes. The one additional node accounts for the Proxy.
Licensing Example 4: Two VPN-1/ FireWall-1 gateways protecting a common internal
network
The diagram below shows two VPN-1/ FireWall-1 gateways protecting a common internal network.
Node n
External Network
Node 2 Node 1
FW-1/
VPN-1
FW-1/
VPN-1
Figure 4. Licencing requirements with multiple VPN-1/ FireWall-1 gateways protecting a common
internal network
Each VPN-1/FireWall-1 gateway requires a license that will support all “n” internal nodes. Because each VPN-
1/FireWall-1 gateway is protecting all internal nodes, each must be licensed accordingly.
Bank Certificate Key (BCK)
Check Point provides direct partners (partners who place orders directly with Check Point) with a Bank
Certificate Key (BCK), which is used to generate a bank of licenses from the on-line licensing center. Each
license is tied to a specific IP Address / Host ID Each license is for a period of 30 days. The number of licenses
the BCK will generate depends on the volume of your activity and should be sufficient for a period of one
quarter.
A direct partner can use the BCK to generate licenses for resellers and end users as well. The BCK should be
used in cases of emergency. It is not intended for evaluation purposes (the Certificate Key on the CD should be
used for this purpose), nor for in house security and demo centers (for this you can purchase a permanent
license at a substantial discount).
The BCK is not intended to be given to resellers or end users to generate their own licenses, but rather the direct
partners should do it for them and provide them with the license.
Once a direct partner has generated most of these licenses, they should request a new Bank Certificate Key by
submitting a request by email to [e-mail]. This request must include the following information:
1. The BCK
2. Type of BCK (VPN type)