The license update feature enables the NX appliance with basic network connectivity to automatically download licenses from the DTI network and install them. This feature provides the following benefits:
Minimal initial configuration—The license update feature is enabled with the configuration jump-start wizard during the initial system configuration. This means the feature can be fully functional after the jump-start wizard is completed.
Simplified license management—There is no need to contact Trellix for license keys when new features are added or when licenses are renewed, because the new licenses are automatically downloaded and installed.
Scalability—Organizations, such as those with a large number of appliances, can benefit from all appliances being updated automatically, instead of entering license keys manually on each appliance, one at a time.
You can enable automatic license updates on the NX appliance using the configuration wizard or the CLI.
How it works
The license update feature, if enabled, downloads and applies licenses to which the customer is contractually entitled. If an active license for a feature is already installed and the licensing service downloads an active license for the feature, the installed license is replaced by the downloaded license only if the downloaded license offers new functionality, a later expiry date, or was part of a more recent customer order. This process is automatic; however, you can also explicitly update licenses.
The license update feature will not:
Install a downloaded license that would cause a feature to become temporarily unlicensed.
Remove a feature license if there is no newly ordered replacement for it.
If you experience issues with a license retrieved from an automatic update, you can use the command no fenet license update enable to disable the automatic update process and you can use the command license install <cr> to manually install your older license key or keys.
You can synchronize the system time to the DTI server time to prevent a feature from being temporarily unlicensed due to time differences. This is a one-time synchronization, but it can be repeated.
When an appliance is managed by the Central Management System appliance, the Central Management System appliance acts as a proxy between the managed appliance and the licensing service. The license update feature must still be enabled on the managed appliance. In such an integrated environment, the Central Management System appliance acts as the DTI server for the managed appliances, so the licensing service uses the Central Management System DTI network credentials instead of the appliance's credentials.
Enabling automatic license updates
This section describes two ways to enable automatic license updates on the Network Security appliance.
Configuration wizard method
The configuration wizard is typically used to initially configure a new system. The wizard steps, which include the following license activation steps, allow a customer to have a functioning system with only minimal configuration.
Enable fenet service.
Enable fenet license update service.
Sync appliance time with fenet.
Update licenses from fenet.
For details about the wizard steps, see Configuration wizard steps .
CLI method
The following topic describes how to use CLI commands to enable and work with the license update feature:
Prerequisites
An established connection between the appliance and the Internet.
Operator or Admin access to enable the license update feature and download and install licenses.
DTI network access to allow the appliance to get updates directly from the DTI network.
(Optional) Admin access to synchronize the system clock with the DTI server clock.
Enabling automatic license updates using the CLI
When the license update feature is enabled, license updates are automatic. You can also explicitly update licenses.
Go to CLI configuration mode:
hostname > enable hostname # configure terminal
Verify the license update feature status:
hostname (config) # show fenet license fenet License Update Service Licensing service: Administratively enabled Last time licensing service was contacted: 2014/08/11 10:50:04 Last time licensing service was contacted successfully: 2014/08/11 10:50:04 Last time keys from licensing service were applied: 2014/08/07 17:50:03
If the license update feature service is disabled, enable it:
hostname (config) # fenet license update enable
Save your changes:
hostname (config) # write memory
Note
See Synchronizing the system clock to DTI server time using the CLI for an option that prevents potential licensing issues if there is a time gap between the two clocks.
Go to CLI configuration mode:
hostname > enable hostname # configure terminal
Update licenses:
hostname (config) # fenet license update
Save your changes:
hostname (config) # write memory
Go to CLI configuration mode:
hostname > enable hostname # configure terminal
Disable the feature:
hostname (config) # no fenet license update enable
Save your changes:
hostname (config) # write memory