Working with Cato License Types

This article explains the different Cato licenses and information in the License screen.

Overview of Cato License Lifecycle and Notifications

Cato provides two types of account licenses: commercial and trial. Customers purchase commercial licenses from Cato for one or more years. The default length of a trial license is 30 days. The start and ending date of Cato licenses are based on UTC+03:00.

These are the different sections in the License window:

Account - The General section shows the status for the account license
Threat Protection services - The Services section shows which Cato Threat Protection licenses are enabled for the account
Public IP addresses - The IPs section shows the number of public IP addresses allocated for the account
Bandwidth - The Bandwidth section shows section shows the bandwidth that has been licensed for each individual site associated with the account (see Managing Site Bandwidth Licenses)
SDP users - The Users section shows the number of licenses for SDP users

To purchase, upgrade, or renew a license, please contact your Cato representative or reseller.

License Life Cycles for Accounts and Sites

Licenses for the entire account and individual sites are valid for a specific length of time and expire on a specific date. The life cycle for the license shows the status for that license:

Commercial - the customer purchased the license it is currently valid
Scheduled - a purchased license that is scheduled to start at a future date
- When you assign a Scheduled license to a site, the site remains disabled and no traffic passes until the start date of the license.
  
  Once the start date is reached, it automatically converts to a Commercial license and the site connects to the Cato Cloud and passes traffic.
  
  For IPsec sites, the expected behavior is that the tunnel is only established when the license switches to Commercial.
- Once the start date is reached, automatically converts to a Commercial license
Trial - a temporary license that is currently valid
Locked - The license for the account or site is expired
- When the account is locked, admins can't log in to the Cato Management Application
- When a site is locked, you can't configure settings for the site
- For reseller accounts, when a sub-account or a site within the sub-account is locked, the reseller admins are able to configure settings for the account or site
- The account or site still passes traffic
- Email alerts and notifications for the account or site aren't sent
Disabled - The license for the account or site is expired for more than a week
- The same impact as Locked (for admins and email alerts)
- The account or site doesn't pass traffic

When a license expires, the account or site is locked for 90 days. Admins can't make changes to the Cato Management Application, but the account, sites (and VPN Clients) are still connected to the Cato Cloud and pass traffic normally.

After the account or site is locked for 90 days, the account is disabled. The entire account or site (and VPN Clients) can't connect to the Cato Cloud and can't connect to networks or the Internet.

Cato sends notifications to customers about expiring licenses as follows:

Account licenses - 30, 14, 7, and 3 days before the license expires
Site licenses - 14, 7, and 3 days before the license expires

Example of Expiring Account License

This is an example of the license notification and expiration process for an account that is using a trial license. In this example, the license expires on January 15th.

January 1st - Cato sends a notification that the trial license expires in 14 days
January 8th - Cato sends a notification that the trial license expires in 7 days
January 12th - Cato sends a notification that the trial license expires in 3 days
January 16th - The trial account license expires:
- The account is locked and Cato sends a notification
- Admins can't make changes to the Cato Management Application
- The sites and VPN Clients have connectivity to the Cato Cloud and the Internet
April 16th - 90 days after the license expires:
- The account is disabled and Cato sends a notification
- That site has NO connectivity to the Cato Cloud or to the Internet

Showing the Licenses

The License window shows sections with the following information:

General - account license
Services - Threat Protection license
IPs - number of available public IP addresses
Bandwidth - site licenses
Users - SDP user licenses for Cato Clients
Lifecycle - changes to license settings

To show the details and status for the licenses:

From the navigation menu, click Administration > License.

Understanding the General License Section

These are the fields for the General account license:

License Type - Shows the account license type: Commercial, Trial, Locked, or Disabled.
License expiration - Shows the calendar date when the account license will expire.
DPA Version - Shows the version of the Data Processing Agreement (DPA) that your company signed with Cato.
Data Retention Period (Months) - Shows the number of months that Cato stores the data for your account.
Automatically disable this account when locked for more than 90 days - When this feature is selected, the account automatically moves from locked to disabled after 90 days. When this feature is disabled, the account moves to disabled after 7 days. By default, this feature is enabled.

This feature is primarily intended for trial and temporary accounts.

Understanding the Services Section

The commercial license life cycle for the Threat Protection services is the same as the account license, and both licenses expire on the same date. Cato sends notifications to customers about an expiring license 14, 7, and 3 days before the license expires.

For trial security Services licenses, the expiration date is usually different than the account.

These are the fields for Services Threat Protection license:

Service - Name for the Threat Protection service in Security > Threat Protection
Enabled - When enabled, the license is active and the service can be enabled for the account
Life Cycle - Shows the service license type: Commercial or Trial
Expiration - For trial licenses, shows the expiration date

Understanding the IPs Section

These are the fields for public IPs for the account:

Licensed - Number of IP addresses assigned to the account
Used - Number of IP addresses that are already allocated in Configuration > Global Settings > IP Allocation
Unused - Number of IP addresses that are currently unassigned and waiting to be allocated

Understanding the Users Section

The Users section shows the number of available licenses for SDP users. Each user can connect to the Cato Cloud with one or more of the VPN Clients for the different operating systems. Disabled SDP users don't use a SDP user license.

When there are no SDP user licenses available (Unused), then you can't add new users to the account:

Directory Services LDAP syncs fail to add new users
You can only manually add new SDP users if an SDP user license is available.

You can use the Export Users feature to generate a CSV report of all the SDP users in your account. For more information, see Generating a Status Report for SDP Users.

The following fields summarize the status of the SDP user licenses:

Licensed - Total number of VPN licenses for the account
Used - Number of active SDP users that are currently assigned a license
Unused - Number of SDP user licenses that are currently unassigned and waiting to be allocated
Disabled - Number of SDP users that are disabled (and can't use the VPN Client to connect to the Cato Cloud)

Assigning SDP User Licenses to Different Users

If you have more users than available SDP user licenses, you can choose to assign the licenses to different users. Disable the current users that no longer require a license, and then enable existing users or create new ones.

For more about working with SDP users, see Managing VPN Users.

To assign SDP user licenses to different users:

From the navigation menu, click Access > Users.
Select the users that you are disabling.
Click Actions > Disable.
In the confirmation window, click OK.
To enable users that are already configured in the Cato Management Application:
1. Select the users that you are enabling with SDP user licenses.
2. Click Actions > Enable.
3. In the confirmation window, click OK.
To create a new user:
1. Click New. The Add User panel opens.
2. Enter the details for the user.
3. Click Apply. The user is added to the Users screen.
4. Click Save. The new user is added to your account.

Understanding the Lifecycle Section

The Lifecycle section in the Licenses window shows the timestamp for changes that were made to licenses in your account.