RE: [FW1] two IP650 running VRRP

["Luke, Jason (ISS Southfield)" <jluke@FW1-NOSPAMiss.net>]

I will assume that their 4.0 license was upgraded from their 3.0 license
(i.e., it was not purchased for the full 4.0 price, but as an upgrade
price.)
You have a bunch of different options depending on what the customer wants.
Currently, their license does not allow the ability to separate the FW from
the mgmt station.  It is not recommended to run the mgmt station on Nokias,
though it could be done.  I will assume that they will want to split the
mgmt station off and use the old Solaris box as the mgmt station.
In any case, they need to upgrade that 4.0 key to 4.1.  This is actually
considered a two step process I believe, first is the upgrade of version
number and second is the upgrade on license functionality.  Probably, you
would upgrade the 4.0 key to a CPFW-FIG-50-v41 plus a CPFW-MOTIF-1-v41, as
these are the 4.1 keys equivalent to your 3.0 keys.  Then you would upgrade
that FIG-50 to a CPFW-FM-50-v41 for the Nokia and a CPFW-EPC-U-mgmt-v41 for
the mgmt station.  With that, you have a 4.1 Nokia and a 4.1 mgmt station
license for 50 users, no encryption, same as you have for 3.0.
The rest is simple.  If you are going to buy another Nokia, you need another
CPFW-FM-50-v41 license, and you would configure VRRP for a hot standby
because its free.  Why have a cold standby when you can have a hot standby
for nothing extra?

If any of my assumptions were incorrect, let me know and I would be happy to
re-evaluate.



-----Original Message-----
From: Glenn Carnagey [mailto:glenn@carnagey.com]
Sent: Saturday, January 27, 2001 4:53 PM
To: fw-1-mailinglist@lists.us.checkpoint.com
Subject: Re: [FW1] two IP650 running VRRP

At 4:13 PM -0800 1/26/01, Raymond N wrote:
>Hi there,
>
>The answer to this question may seem obvious, but I guess it doesn't hurt
>to ask.
>
>I have one Firewall-1 (Enterprise license) running on Sun Solaris right
>now.  I am thinking to buy two IP650 and use VRRP for fail-over.  Do I need
>to buy an additional license for the second IP650 (assuming I can transfer
>the exiting license on Sun to the first IP650)?
>
>I am going to ask my reseller, but I am almost sure he would say "yes"
>without a second thought.

I have a somewhat similar licensing question:

A client has a single Sun Ultra 1 running CP 3.0 SP9 on Solaris 
2.5.1, they have a 50stdlightmotif license, but they already have 
their 4.0 key and software.   We're hoping to go with 2 Nokias, but 
either:
	a.)  2 Nokias, one a cold backup, same or a 2nd 50 license
	b.)  1 Nokia, beef up the old Sun for a cold backup, new 50 
license for the Nokia
	c.)   2 Nokias with VRRP

CP 4.1 SP2 on any of these solutions (SP3 if we can't get the Sun out 
of the loop), looking at the IP440 for the Nokias.

Obviously, we want them to go with the latter (basically, the diagram 
at http://www.nokia.com/securitysolutions/network/availability.html), 
but we're having a lot of difficulty getting a straight answer on 
what the licensing and upgrade situation needed for that scenario is. 
3 answers from 3 different companies' salesman.   Anyone know?




-- 
---
Glenn Carnagey
Pathfinder Associates, LLC, Faxglenn@pathf.com


============================================================================
====
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
============================================================================
====


================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================