Cato Networks Knowledge Base

Search

Working with Cato License Types

This article explains the different Cato licenses and information in the License screen.

Overview of Cato License Lifecycle and Notifications

Cato provides two types of account licenses: commercial and trial. Customers purchase commercial licenses from Cato for one or more years. The default length of a trial license is 30 days. The start and ending date of Cato licenses are based on UTC+03:00.

These are the different sections in the License window:

  • Account - The General section shows the status for the account license

  • Threat Protection services - The Services section shows which Cato Threat Protection licenses are enabled for the account

  • Public IP addresses - The IPs section shows the number of public IP addresses allocated for the account

  • Sites - The Sites section shows section shows the bandwidth that has been licensed for each individual site associated with the account

  • SDP users - The Users section shows the number of licenses for SDP users

To purchase, upgrade, or renew a license, please contact your Cato representative or reseller.

License Life Cycles for Accounts and Sites

Licenses for the entire account and individual sites are valid for a specific length of time and expire on a specific date. The life cycle for the license shows the status for that license:

  • Commercial - the customer purchased the license it is currently valid

  • Scheduled - a purchased license that is scheduled to start at a future date

    • When you assign a Scheduled license to a site, the site remains disabled and no traffic passes until the start date of the license.
      Once the start date is reached, it automatically converts to a Commercial license and the site connects to the Cato Cloud and passes traffic.
      ​For IPsec sites, the expected behavior is that the tunnel is only established when the license switches to Commercial.

    • Once the start date is reached, automatically converts to a Commercial license

  • Trial - a temporary license that is currently valid

  • Locked - The license for the account or site is expired

    • Admins can't configure the entire account or the specific site

    • The account or site still passes traffic

    • Email alerts and notifications for the account or site aren't sent

  • Disabled - The license for the account or site is expired for more than a week

    • The same impact as Locked (for admins and email alerts)

    • The account or site doesn't pass traffic

When a license expires, the account or site is locked for 90 days. Admins can't make changes to the Cato Management Application, but the account, sites (and VPN Clients) are still connected to the Cato Cloud and pass traffic normally.

After the account or site is locked for 90 days, the account is disabled. The entire account or site (and VPN Clients) can't connect to the Cato Cloud and can't connect to networks or the Internet.

Cato sends notifications to customers about expiring licenses as follows:

  • Account licenses - 30, 14, 7, and 3 days before the license expires

  • Site licenses - 14, 7, and 3 days before the license expires

Working with Unlicensed Sites

Sites in your account can be unlicensed, and these sites do not pass any traffic. When you create a new site, you can choose to not assign a license to it. You can also disable a site, and then unassign the license from it.

When you unassign a license from a site, all traffic is immediately disabled for the site, even if the site is still enabled.

You can have up to 1000 unlicensed sites in your account.

 

Example of Expiring Account License

This is an example of the license notification and expiration process for an account that is using a trial license. In this example, the license expires on January 15th.

  • January 1st - Cato sends a notification that the trial license expires in 14 days

  • January 8th - Cato sends a notification that the trial license expires in 7 days

  • January 12th - Cato sends a notification that the trial license expires in 3 days

  • January 16th - The trial account license expires:

    • The account is locked and Cato sends a notification

    • Admins can't make changes to the Cato Management Application

    • The sites and VPN Clients have connectivity to the Cato Cloud and the Internet

  • April 16th - 90 days after the license expires:

    • The account is disabled and Cato sends a notification

    • That site has NO connectivity to the Cato Cloud or to the Internet

Understanding Site License Types

There are two types of licenses for sites in your account, depending on how the site connects to the Cato Cloud.

  • SASE license

    • Supports all networking (SD-WAN) and security features

    • Socket and vSocket sites must use SASE licenses

    • IPsec sits can choose to use SASE licenses

  • SSE license

    • Supports all security features, partial support of networking features (no SD-WAN)

    • IPsec sites can use SSE licenses

Showing the Licenses

The License window shows sections with the following information:

  • General - account license

  • Services - Threat Protection license

  • IPs - number of available public IP addresses

  • Sites - site licenses

  • Users - SDP user licenses for Cato Clients

  • Lifecycle - changes to license settings

To show the details and status for the licenses:

  • From the navigation menu, click Administration > License.

License_General.png

Understanding the General License Section

These are the fields for the General account license:

  • License Type - Shows the account license type: Commercial, Trial, Locked, or Disabled.

  • License expiration - Shows the calendar date when the account license will expire.

  • DPA Version - Shows the version of the Data Processing Agreement (DPA) that your company signed with Cato.

  • Data Retention Period (Months) - Shows the number of months that Cato stores the data for your account.

  • Automatically disable this account when locked for more than 90 days - When this feature is selected, the account automatically moves from locked to disabled after 90 days. When this feature is disabled, the account moves to disabled after 7 days. By default, this feature is enabled.

    This feature is primarily intended for trial and temporary accounts.

Understanding the Services Section

The commercial license life cycle for the Threat Protection services is the same as the account license, and both licenses expire on the same date. Cato sends notifications to customers about an expiring license 14, 7, and 3 days before the license expires.

For trial security Services licenses, the expiration date is usually different than the account.

These are the fields for Services Threat Protection license:

  • Service - Name for the Threat Protection service in Security > Threat Protection

  • Enabled - When enabled, the license is active and the service can be enabled for the account

  • Life Cycle - Shows the service license type: Commercial or Trial

  • Expiration - For trial licenses, shows the expiration date

Understanding the IPs Section

These are the fields for public IPs for the account:

  • Licensed - Number of IP addresses assigned to the account

  • Used - Number of IP addresses that are already allocated in Configuration > Global Settings > IP Allocation

  • Unused - Number of IP addresses that are currently unassigned and waiting to be allocated

Understanding the Sites Section

The Sites section shows the number of available licenses for sites, and the license details for each site.

Available Site Licenses

The following fields summarize the status of the site licenses:

  • Licensed - Total number of site licenses in the account

  • Used - Number of site licenses that are currently assigned to sites

  • Unused - Number of site licenses that are currently unassigned and waiting to be allocated

  • Waiting for - Number of sites waiting for a license to be assigned to them

Site License Details

The following fields explain the details of each site license:

  • Allocated - The site which the license is allocated to

  • Zone - Geographical zone for the license, each zone contains several countries

  • Country - Country for the physical site (Configuration > Sites > General)

  • Bandwidth - Maximum available bandwidth over the Cato Cloud for the site

  • Life Cycle - Shows the site license type: Commercial, Trial, Locked, or Disabled

  • Expiration - For trial licenses, shows the expiration date

  • Modified on - Shows the most recent time that the site license was modified

Allocating a License to a Different Site

You can use the Sites section to change the site license to a different site. You can allocate a license that is unassigned, or exchange licenses between two sites.

You must allocate a license to each site in the account, even if a site is disabled.

To allocate a license to a different site:

  1. From the navigation menu, select Administration > License and go to the Sites section.

  2. In the site that you are changing the site license, click the Allocated column.

    The Edit panel opens.

  3. In the Allocated drop-down menu, select Unassigned.

  4. If necessary, repeat the previous two steps to allocate the other site with a license.

  5. Click Apply. The changes are updated.

  6. Click Save. The site license is allocated to a different site.

Understanding the Users Section

The Users section shows the number of available licenses for SDP users. Each user can connect to the Cato Cloud with one or more of the VPN Clients for the different operating systems. Disabled SDP users don't use a SDP user license.

When there are no SDP user licenses available (Unused), then you can't add new users to the account:

  • Directory Services LDAP syncs fail to add new users

  • You can only manually add new SDP users if an SDP user license is available.

You can use the Export Users feature to generate a CSV report of all the SDP users in your account. For more information, see Generating a Status Report for SDP Users.

The following fields summarize the status of the SDP user licenses:

  • Licensed - Total number of VPN licenses for the account

  • Used - Number of active SDP users that are currently assigned a license

  • Unused - Number of SDP user licenses that are currently unassigned and waiting to be allocated

  • Disabled - Number of SDP users that are disabled (and can't use the VPN Client to connect to the Cato Cloud)

Assigning SDP User Licenses to Different Users

If you have more users than available SDP user licenses, you can choose to assign the licenses to different users. Disable the current users that no longer require a license, and then enable existing users or create new ones.

For more about working with SDP users, see Managing VPN Users.

To assign SDP user licenses to different users:

  1. From the navigation menu, click Access > Users.

  2. Select the users that you are disabling.

  3. Click Actions > Disable.

  4. In the confirmation window, click OK.

  5. To enable users that are already configured in the Cato Management Application:

    1. Select the users that you are enabling with SDP user licenses.

    2. Click Actions > Enable.

    3. In the confirmation window, click OK.

  6. To create a new user:

    1. Click New. The Add User panel opens.

    2. Enter the details for the user.

    3. Click Apply. The user is added to the Users screen.

    4. Click Save. The new user is added to your account.

Understanding the Lifecycle Section

The Lifecycle section in the Licenses window shows the timestamp for changes that were made to licenses in your account.

Was this article helpful?

1 out of 3 found this helpful

Comments

0 comments

Please sign in to leave a comment.