Checkpoint SVA service fails due to license issues

Products

• VMware NSX for vSphere

Issue/Introduction

Symptoms:

• In the NSX Manager vsm.log file, you see entries similar to:

INFO http-nio-127.0.0.1-7441-exec-71 VsmAgentController:41 - Received agentId = vsmagent-201, status = AgentHealthStatusDto [status=DOWN, errorDescription=Failed installing policy.
Please make sure you have managing license for Management Server, then install policy manually from Domain Server Smart Console. Last Update:[11/07/17.21:58:06]]

http-nio-127.0.0.1-7441-exec-71 VsmAgentFacadeImpl:49 - Received agentId = vsmagent-201, status = AgentHealthStatusDto [status=DOWN, errorDescription=Failed installing policy.
Please make sure you have managing license for Management Server, then install policy manually from Domain Server Smart Console.

• Running the command "cplic print" in the affected SVA, you do not see any license information.

> cplic print
Host             Expiration  Features

•  If more hosts are added to the cluster than the available licenses, additional hosts will not be supported and fails with errors.

 
 

Environment

VMware NSX for vSphere 6.3.x
VMware NSX for vSphere 6.2.x

Cause

This issue occurs when all the available licenses are utilized and more hosts were added to the cluster.

Resolution

To check the license information on the checkpoint manager:

• Log into the checkpoint manager in expert mode.
• Type the command: vsec_config and follow the on screen instructions:

***************************************
     VSEC Service Manager Menu
****************************************

1. VMware Configuration
2. Cisco ACI Configuration
3. Exit

Selected option: 1

***************************************************
vSEC VMware Service Manager Menu
***************************************************

1. Change Global Configuration
2. Licensing
3. Register Service
4. Show Services
5. Remove Service
6. Reload Data Center Servers list
7. Check Connection
8. Back

Selected option: 2

Select an option:

1. Attach vSEC license
2. Detach vSEC license
3. show license attachments
4. Back

Selected option:3

Cluster name to license details:
1. 'Check_Point_VSEC_Service_D1DCVB01-D1DCVB-1_TNT01' : 'xx.xx.xx.xx never xxxxxx cpsg-vsec-nsx+32 cpsb-fw cpsb-vpn cpsb-ia cpsb-ips-s1 cpsb-urld cpsb-apcl-s1 cpsb-av cpsb-abs cpsb-aspm
2. 'Check_Point_VSEC_Service_D2DCVB01-D2DCVB-1_TNT01' : 'xx.xx.xx.xx never xxxxxx cpsg-vsec-nsx+36 cpsb-fw cpsb-vpn cpsb-ia cpsb-ips-s1 cpsb-urld cpsb-apcl-s1 cpsb-av cpsb-abs cpsb-aspm

As above example, cpsg-vsec-nsx+36 applied to 18 ESXi hosts of 2 CPUs. Additional hosts added to the cluster will be not supported and SVA service fails to start.

To resolve this issue, add the additional licenses in the environment.