One of our customer bought a new UTM-1 2070 appliance. This device comes with 3 managed sites.
Now he wants to manage more sites and brought up the question, if he can use a SmartCenter unlimited license he already owns. Just purchasing normal support for SCT-U is cheaper than buying an SXA license and the needed support for this license.
I don’t know if Check Point license policy is allowing that use, but from a technical point of view we can verify if this works.
For that reason, we have to take a look inside the cp.macro file. This file has all the definitions of features and licenses.
On SecurePlatform, you find this file under /var/opt/CPshrd-R70/conf/cp.macro
If we look in the license for an UTM-1 2070, we find these two strings: CPMP-UAPP-1-NGX CPXP-SXA-2-NGX
The first is for the appliance itself, the second is the management extension for two additional sites.
Let’s break down the first one:
For CPMP-UAPP-1-NGX, we have the following relevant entry:
MACRO ::CPMP-UAPP-1-NGX CPMP-UAPP-module-base-NGX CPMP-UAPP-management-base-NGX CPVP-UAPP-1-NGX
That means that actually the string is a macro itself and consists of CPMP-UAPP-module-base-NGX, CPMP-UAPP-management-base-NGX and CPVP-UAPP-1-NGX.
Let’s focus on CPMP-UAPP-management-base-NGX:
cp.macro has this definition for it:
MACRO ::CPMP-UAPP-management-base-NGX CPMP-SCT-1-NGX CPFW-AM-U-NGX CPMP-HA-MGMT-NGX CPMP-SMPO-NGX CPMP-EVRX-U-NGX
So this is another macro for the SmartCenter (CPMP-SCT-1), SmartDirectory (CPFW-AM-U), Management-HA (CPMP-HA-MGMT), SmartPortal (CPMP-SMPO) and Eventia Reporter (CPMP-EVRX-U).
We go for the SmartCenter part:
MACRO ::CPMP-SCT-1-NGX CPMP-EMC-1-NGX
Again a macro, so we need to investigate CPMP-EMC-1-NGX:
MACRO ::CPMP-EMC-1-NGX fw1:6.0:lcontrol fw1:6.0:vpnmgmt fw1:6.0:vpnstrong fw1:6.0:remote1 fw1:6.0:cluster-u
Now we’re close to the final answers 
The macro fw1:6.0:lcontrol has this definitions:
MACRO fw1:6.0:lcontrol mgmtcore fwmgmt cpui qosmgmt cmpmgmt dbvr_unlimit cluster-u
This breaks down to:
MACRO fw1:6.0:mgmtcore cmd
+--#DESCRIPT#fw1:6.0:cmd#Saving a file from the log viewer
MACRO fw1:6.0:fwmgmt fwc filter
+--#DESCRIPT#fw1:6.0:fwc#INSPECT compiler
+--#DESCRIPT#fw1:6.0:filter#INSPECT code generation
MACRO fw1:6.0:cpui policyui lvui sstui rtmui
+--MACRO fw1:6.0:policyui ui
+--#DESCRIPT#fw1:6.0:ui#Policy User Interface
+--MACRO fw1:6.0:lvui fwlv
+--#DESCRIPT#fw1:6.0:fwlv#FireWall-1 Log Viewer
+#DESCRIPT#fw1:6.0:sstui#System Status User Interface
+#DESCRIPT#fw1:6.0:rtmui#RTM User Interface
MACRO fw1:6.0:qosmgmt fgmgmt rtmmgmt
+--#DESCRIPT#fw1:6.0:fgmgmt#FloodGate-1 Management
+--#DESCRIPT#fw1:6.0:rtmmgmt#RTM Management
MACRO etm:6.0:cmpmgmt
+--#DESCRIPT#etm:6.0:cmpmgmt#Compression management
dbvr_unlimit
+--#DESCRIPT#fw1:6.0:dbvr_unlimit#Policy Versioning
cluster-u
+--#DESCRIPT#fw1:6.0:cluster-u#Unlimited number of clusters for HA
Finally, we have found out the management related features hidden in the license:
Policy User Interface
FireWall-1 Log Viewer
Saving a file from the log viewer
System Status User Interface
RTM User Interface
INSPECT code generation
INSPECT compiler
Policy Versioning
Compression management
Unlimited number of clusters for HA
But it is not said, how many sites can be managed.
This information is in the last “big” macro CPMP-EMC-1-NGX, coded in
fw1:6.0:remote1
#DESCRIPT#fw1:6.0:remote#Allows remote management
So you can manage one site with this license, e.g. the UTM-1 appliance can manage itself.
But the UTM-1 2070 comes with a 3 managed sites license.
This is defined in the CPXP-SXA-2-NGX addition to the UTM-1 license:
MACRO ::CPXP-SXA-2-NGX fw1:6.0:remote2 fw1:6.0:cpxmgmt
#DESCRIPT#CPXP-SXA-2-NGX#SmartCenter Extension for 2 additional sites; version: NGX; 3DES
We have remote1 and remote2, which comes to the count of 3 managed sites.
So, back to the initial question: can we use a SCT-U license for extending the managed sites of an UTM-1?
MACRO ::CPMP-SCT-U-NGX CPMP-EMC-U-NGX
#DESCRIPT#CPMP-SCT-U-NGX#SmartCenter for an unlimited number of gateways;version: NGX; 3DES
Again, look into the next macro CPMP-EMC-U-NGX
MACRO ::CPMP-EMC-U-NGX fw1:6.0:controlx fw1:6.0:vpnstrong
#DESCRIPT#CPMP-EMC-U-NGX#Enterprise Management Console for an unlimited number of gateways; version: NGX; 3DES
From there we go into fw1:6.0:controlx:
MACRO fw1:6.0:controlx control vpnmgmt
And further onto control:
MACRO fw1:6.0:control remote lcontrol
We know the “lcontrol” macro from our investigation before, also the “remote” keyword.
#DESCRIPT#fw1:6.0:remote#Allows remote management
As “remote” comes without any number, this means unlimited management.
To answer the question we began with: YES, you can use an unlimited SmartCenter license as an extension of the management capabilities of an UTM-1 appliance.
From a technial point of view.
I will open a call with Check Point to make sure that this is actually permitted within the license regulations.
As you can see, licensing within Check Point products is complicated through the use of so many macros, but in the end it comes to a limited number of features that are encoded in the licenses.
If you will, you can chase down also the new Software Blade licenses with this scheme to see, what is actually enforced.
Tobias Lachmann
UPDATE: Check Point just confirmed that the use of a SmartCenter license on a UTM-1 appliance is not permitted to extend the amount of managed sites. You have to stick with the SXA extensions or build up a separate SmartCenter.
