Professional Documents
Culture Documents
How To Sell Hillstone 407. License v3.0
How To Sell Hillstone 407. License v3.0
How To Sell Hillstone 407. License v3.0
2022
2 Platform Licenses
5 License Bundle
6 License Q&A
2
Licenses Overview
3
Inside Hillstone License File
It is just a sample/ Don’t be scared. You will receive the license file and
upload it, you don’t need to play with the encrypted string unless you play
with CLI.
license:YdoA2xT2HMlgN21h+H0LDNrWFht25WqNLpRi4/4ehzqeu61HhBLK9CkqsMyZeNUfz0tHFi7Y5
+6eh4sw2UMuNoUaGd/8ZG5bvLGQtkBhYGOtfNAWHS3LdM6O3N24EFZcm/JlC6ogm+wYGvD0VtcY
BZIn1bRS6Jast797rcoWIb3YYHbYoKRvnP2aE/dXxxeK8qYP2LfjlZtoRYiAA4dwgxAhIpZAUu+oNbXYea
svKzg/g/sc6X2fjbycPaEjzkJ/BrjBqqa1940c0yT8T20iUx1yuJ5FkKbksu8DBnzIU9hfjW3bvyOae8I32eFYs
9dyYcX7el1m9eZKdg0vr4EJgRHaJ8j74dr7uZzkce77ScT/7oECQbT+91faNLt4vIV+F+qT6GDyyWv75Q
LLpiw5rayL/Tkn5FItc05VKU8Z7D1vLvsfrSDfwO7FI5gFJsMCA5IWYLnkLFNLKQKrHDuu5dC9ac7OWI4
/x72hd1X6siVil/8a9zhlZMv1FIfKIp7za+tu/fNiAlp40Ueps4SHU4X9X+GEwYK0fucgz6XPRMbjLxaoZTcTn
1wj9CGPY9pk1Y062Rg6tD3Yx6SnJYVZ5XIsWM8XaBUKCqfBVvbjUHutPLt9SuX/6aTkvcTNEHey4mR
NCgilUYMoOu961QIhwt+5Pw221W/Md7Zp6lpHIw9JUFYmOsSRxADW1+HfvPMJkO08Tek+asecijgSB
9C4eg2Wvq7JeWlpHAyYfkTKGOaQP1ePrAGLp+iSvdj8zNUnVFcOrG4Q0mlHCNQl7PRRwKyKvuNpu
DP3afQItNueVkK+8JXeipAkliXWKggbr/EADzyu5bSfR+HNrXKZj2uMSnQQuR28La5cNQ2nS49wkYZfN
NJvHhNKiJ8JQgiKIsG+jXKf8UgfSJ93RyPHwMu9zBIIkDWL4RRsMQ/qlWCt/e1Z9W3zeI4NrWXZsuSV
XidmJ3Dks834KZB8VPpI0nQSOs6/DcSInzVkxufQM4JzeKXkbfUvKsgVFzM/SVTVl1As
4
Firewall Licenses Overview
Feature &
Platform Subscription Capacity
AV QoS
IPS Twin-Mode
Platform Base
URL VSYS
IP reputation
AEL
APPDB
SSLVPN
StoneShield
SandBox IPSec for CloudEdge
Platform Trial
Anti-Spam Feature Trial
Botnet C&C Prevention HSM Device
5
Licenses Availability - Product Line
License E/E-Pro T A X CloudEdge CloudHive NIPS sBDS HSA HSM ADC vWAF iSource
Platform Base Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Platform Trial Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
IPS Yes Yes Yes Yes Yes Yes Yes Yes (IDS)
APPDB Yes Yes Yes Yes Yes Yes Yes Yes Yes
SPM Yes
SD-WAN Yes
6
GSLB Yes
Platform Licenses
7
Platform Trial
License E/E-Pro A X CloudEdge CloudHive NIPS sBDS ADC WAF iSource
Platform Trial Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Control To enable basic firewall, Anti-DDOS and IPSec VPN functions for customer trial for firewall, or enable
basic CoudHive, NIPS, sBDS, ADC, WAF etc. products functions. Or full iSource functions
Valid Time The license has the trial period (in number of days) embedded. For example, a 15-Day trial license
will enable the device to active for 15 days, during that 15 days period of time, the basic firewall, Anti-
DDOS and IPSec VPN functions for firewall are available for trial.
After Expiration The configuration cannot be changed anymore. If the device powers down and up again, the default
configuration will be loaded. Previous customized configuration is still available (stored in device’s
flash), so if you want to re-activate it, you need to upload a new trial license and reboot WITHOUT
‘save configuration’ (if you perform ‘save conf’, your customized configuration will be overwritten by
the default configuration content)
Notes There is a countdown timer in the trial license that it counts the time the device powers up. For
example, for a 15-Day trial license, if the customer receives the trial equipment but doesn’t power it
on for 5 days, that 5 days won’t be counted as the trial period in the license. When the customer
powers up the device to start the trial after 5 days idle, it can still run for 15 days.
Platform trial is incremental, do not delete the old platform trial license even it expired already, you
just need to install the new trial license to increase the trial period.
If commercial license installed, the trial license will not work anymore. 8
Platform Base
License E/E-Pro A X CloudEdge CloudHive NIPS sBDS HSA HSM ADC WAF iSource
Platform Base Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Control To enable basic firewall and IPSec VPN functions of E/T/X/V (CloudEdge and CloudHive) firewall
products for production use. Or enable NIPS, sBDS, ADC, WAF, HAS, HSM basic functionalities.
It is a MUST for all Hillstone products. Always remember to procure and install the Platform
Base for any production use.
Valid Time The license has the license expiration date (for example, April 7, 2021) built in. It is the hardware
warranty and software service expiration date
After Expiration The customer can still use the device and make changes to the configuration as normal. Just device
firmware cannot be upgraded to the version released after the license expiration date. The hardware
warranty also expires after that date.
Notes The base license has the end-user information built in. Such information can be visible from CLI (show
license) and WebUI (System->License). It is a good way to check the warranty expiration date, and if
the devices has the correct owner.
9
Subscription Service Licenses
10
AV Subscription Service License
License E/E-Pro A X CloudEdge CloudHive NIPS sBDS
AV Yes Yes Yes Yes Yes Yes Yes
Control To enable AV feature and regular AV signature update from Hillstone security service cloud.
Valid Time The license has the license expiration date (for example, April 7, 2021) built in. It indicates the
AV subscription service expiration date.
After Expiration The AV scanning feature is still available, the AV related configuration is intact. But the device
cannot get the most updated AV signature from the cloud.
Notes During the POC, in order to have the trial of the AV feature, in addition to the platform trial
license, the AV license is also needed.
11
IPS Subscription Service License
License E/E-Pro A X CloudEdge CloudHive NIPS sBDS
IPS Yes Yes Yes Yes Yes Yes Yes (IDS)
Control To enable IPS feature and regular IPS signature update from Hillstone security service cloud
for E/A/X/V (CloudEdge and CloudHive) firewall products and NIPS, sBDS
Valid Time The license has the license expiration date (for example, April 7, 2021) built in. It indicates the
IPS subscription service expiration date.
After Expiration The IPS feature is still available, the IPS related configuration is intact. But the device cannot
get the most updated IPS signature from the cloud.
Notes q For NIPS products, there is no need to purchase IPS license separately. It will come with
the platform base license, and share the same expiration date as the platform base
license.
q During the POC for the firewall products (E/A/X/V) and sBDS, in order to have the trial of
the IPS feature, in addition to the platform trial license, the IPS license is also needed.
12
URL Filtering Subscription Service
License E/E-Pro A X CloudEdge CloudHive NIPS
URL Yes Yes Yes Yes Yes Yes
Control To enable URL Filtering feature and regular URL category database update from Hillstone
security service cloud
Valid Time The license has the license expiration date (for example, April 7, 2021) built in. It indicates
the URL Filtering subscription service expiration date.
After Expiration The URL Filtering feature is still available, the URL Filtering related configuration is intact. But
the device cannot get the most updated URL category database from the cloud. The local
cache of the URL database it gets from the cloud will expires within days, but the user-
defined URL category will still be available.
Notes During the POC for the firewall products (E/A/X/CloudEdge) and NIPS products, in order to
have the trial of the URL Filtering feature, in addition to the platform trial license, the URL
Filtering license is also needed.
13
APPDB Subscription Service License
License E/E-Pro A X CloudEdge CloudHive NIPS sBDS ADC
APPDB Yes Yes Yes Yes Yes Yes Yes Yes
Control To enable APPID database update from Hillstone security service cloud.
Valid Time The license has the license expiration date (for example, April 7, 2021) built in. It indicates the
APPID database update service expiration date.
After Expiration The application control feature is still available, the application control related configuration is
intact. But the device cannot get the most updated APPID database from the cloud.
Notes There is no need to purchase the APPDB license separately. The APPDB license is always
issued together with the platform base license, and has the same expiration date as the
platform base license.
14
IP Reputation Subscription Service License
License E/E-Pro A X CloudEdge NIPS WAF
IP reputation Yes Yes Yes Yes Yes Yes
Control To enable IP Reputation function of predefined black list and IP reputation database update
from Hillstone security service cloud.
Valid Time The license has the license expiration date (for example, April 7, 2021) built in. It indicates the
IP Reputation subscription service expiration date.
After Expiration The PTF feature is still available, the IP Reputation related configuration is intact. But the
device cannot get the most updated IP reputation database from the cloud.
Notes It is the new license only available after firmware release 5.5R6.
15
Botnet C&C Prevention Subscription Service License
License E/E-Pro A X CloudEdge NIPS sBDS
Botnet C&C Prevention Yes Yes Yes Yes Yes By StoneShield
Control To enable cloud Botnet C&C Prevention feature from Hillstone security service cloud.
Valid Time The license has the license expiration date (for example, April 7, 2021) built in. It indicates
the Botnet C&C Prevention service expiration date.
After Expiration The Botnet C&C related configuration is intact. But the device cannot get the most Botnet
C&C Prevention service from the cloud.
16
Anti-Spam Subscription Service License
License A NIPS sBDS
Anti-Spam Yes Yes Yes
Control To enable cloud Anti-Spam feature from Hillstone security service cloud.
Valid Time The license has the license expiration date (for example, April 7, 2021) built in. It indicates
the Anti-Spam service expiration date.
After Expiration The Anti-Spam related configuration is intact. But the device cannot get the most Anti-Spam
service from the cloud.
Notes This license is available on all A series models (except A200), and also available on NIPS
and sBDS.
17
Sandbox Subscription Service License
License E/E-Pro A X CloudEdge NIPS sBDS
Sandbox Yes Yes Yes Yes Yes Yes
Control To enable cloud Sandbox feature from Hillstone security service cloud.
Valid Time The license has the license expiration date (for example, April 7, 2021) built in. It indicates
the Sandbox service expiration date.
After Expiration The Sandbox related configuration is intact. But the device cannot get the most Sandbox
service from the cloud.
18
StoneShield Subscription Service
License NIPS sBDS
StoneShield Yes Yes
Control To enable a package of intelligent features, including Abnormal Behavior Detection, Advanced
Threat Detection, and corresponding database update from Hillstone security service cloud.
Valid Time The license has the license expiration date (for example, April 7, 2021) built in. It indicates the
StoneShield database update service expiration date.
After Expiration The intelligent features are still available, the related configuration is intact. But the device
cannot get the most updated intelligent database from the cloud.
Notes q The StoneShield license is available on NIPS products. They need to be purchased
separately if needed.
q It is also available on sBDS products, but there is no need to purchase it separately, it will
come with the sBDS platform base, and it shares the same expiration date as the platform
base.
19
SPM License for CloudHive
License CloudHive
SPM Yes
20
Feature and Capacity Licenses
21
QoS Feature License
License E/E-Pro A X CloudEdge NIPS ADC
QoS Yes Yes Yes Yes Yes Yes
Valid Time The license has the license expiration date (for example, April 7, 2021) built in.
After Expiration The QoS feature is still available, the QoS related configuration is intact. But the QoS related
technical support is not available.
Notes q During the POC for the firewall products (E/A/CloudEdge), in order to have the trial of the
QoS feature, in addition to the platform trial license, the QoS license is also needed.
q On X series products, there are two ways to support QoS
l Dedicated QoS service module (QSM). No extra QoS license is needed once the
QSM hardware is installed.
l Software based license, no hardware module needed, support from 5.5R5F1
22
VSYS Feature and Capacity License
License E/E-Pro A X ADC
VSYS Yes Yes Yes Yes
Control To enable VSYS feature, and number of virtual systems per hardware unit supports.
After Expiration Once issued and installed, the feature never expires. It has the number of VSYS embedded in
the license.
Notes q It is a incremental license. For example, one hardware has two VSYS license, one with 5
VSYS, another with 10 VSYS. The total number of VSYS it will support is 15 after both
license installed.
q The VSYS is not available in some lower-end models such as E1100W and E1600, A200,
A1000 and A1100
23
SSLVPN Feature and Capacity License
License E/E-Pro A X CloudEdge
SSLVPN Yes Yes Yes Yes
Control To enable SSLVPN (Hillstone SCVPN) feature, and control the number of concurrent SSLVPN
users.
After Expiration Once issued and installed, the feature never expires. It has the number of concurrent SSLVPN
users embedded in the license.
Notes q It is a incremental license. For example, one hardware has two SSLVPN license, one with 100
users, another with 150 users. The total number of concurrent users it will support is 250 after
both license installed.
q The number of users it controls is the concurrent users to have SSLVPN connections, not total
number of users. For example, if the customer has the 250-User SSLVPN license, the customer
can still enable SSLVPN connections for 1000 users by creating 1000 user accounts, as far as
those 1000 users won’t be connecting to the SSLVPN simultaneously.
q Each hardware model may has certain number of free SSLVPN connections capacity by default,
please check datasheet for more detailed information.
24
Additional Enhanced License (AEL)
License E NIPS
AEL Yes Yes
Control For selected E and NIPS models, the AEL (Advanced Expansion License) license enables
more concurrent session capacity and more performance.
After Expiration Once issued and installed, the feature never expires.
Notes q Current models support AEL expansion: E1700, E2300, E2800, S600, S1060, S1560,
S2160, S2660, S3560, S3860, S5560
q For detailed capacity and performance it controls, please check datasheet.
25
IPSec License for CloudEdge
License CloudEdge
IPSec Yes
After Expiration Once issued and installed, the feature never expires.
Notes q Currently there is no need to purchase IPSec license separate for CloudEdge, it will come
with the CloudEdge platform base license when CloudEdge product is purchased.
q There is no need to install IPSec license for other firewall products (E/A/X) to have IPSec
feature.
26
HSM Device License
License HSM
HSM Device Yes
27
SD-WAN Device License
License HSM
SD-WAN Yes
Control It controls number of SD-WAN devices the HSM product can manage.
Valid Time It is a permanent license.
After Expiration Never Expire
Notes q The device number managed by SD-WAN license shouldn't be less than the device
number managed by HSM license, it must same as the HSM device license or higher than
that.
q It is a incremental license.
28
Twin-Mode HA Feature License
License E/E-Pro A X
Twin-Mode Yes Yes Yes
Valid Time The license has the license expiration date (for example, April 7, 2021) built in.
After Expiration The Twin-Mode feature is still available, the Twin-Mode related configuration is intact. But the
Twin-Mode related technical support is not available.
Notes q All devices (4) in the twin-mode HA cluster need to install this license
29
GSLB License
License ADC
GSLB Yes
30
Feature Trial License
License E E-Pro A X CloudEdge
Feature Trial Yes Yes Yes Yes Yes
Control It enables QoS, SSLVPN (to maximum platform capacity) and VSYS (to maximum platform
capacity, if the feature is available for specific model) for trial purpose.
Valid Time It is a trial license similar to platform trial license, it counts the device power on time period.
After Expiration The above mentioned feature is not available anymore. The configuration is intact, but it will
not function properly.
Notes 1. To test VSYS feature with feature trial license, it is needed to enable VSYS in the CLI.
Exec feature-trial vsys enable
2. For SSLVPN test, it is better to install feature trial license, do not use “SA SSL VPN” as it
may have some issues for such SSLVPN trial license.
31
License Bundle
32
BDL License
License E/E-Pro A X CloudEdge NIPS sBDS
Bundle license is just a business term, not a license by itself. It is the collective name of several licenses combined
together. When BDL is purchased, the customer still gets the individual licenses specified in such bundle. It is to
simplified ordering process, as well as offer better discount when multiple licenses are ordered at the same time.
Bundle AV IPS URL QoS StoneShield IP Reputation Botnet C&C Anti-Spam Sandbox
Prevention
BDL (A) Yes Yes Yes Yes Yes Yes Yes Yes
BDL (NIPS) Yes Yes Yes Yes Yes Yes Yes Yes
33
License Q&A
34
License Q&A - 1
Can I move the license from one hardware to another (same model)?
No. Hillstone license is tied to the SN and security key embedded in each hardware. The SN and security key is
programmed during the manufacturing phase, cannot be changed after production, and it is unique for each
hardware unit. So the license for one hardware cannot be used in another hardware, even though they are exactly
the same model.
Hillstone license has the end-user information embedded in itself. The end user information will be shown in the
user interface. The end user can check if the device is really belong its own organization, it is also the proof of the
valid warranty.
35
License Q&A - 2
How does Hillstone license scheme help with deal protection?
Since Hillstone’s license is tied to the SN and security key embedded in the hardware, it is not possible to
countified or change the license itself after issuing. They are two steps for deal protection
q If partner A successfully registers the project for end user Enterprise-Z, Hillstone will only issue the license with
end user Enterprise-Z, to partner A. If other partners want to purchase the same model and want to have the
end user information as Enterprise-Z, Hillstone will refuse to do so.
q During the warranty and technical support, if the end user Enterprise-Y requests the support, but its license
shows the end user information as Enterprise-Z, Hillstone will refuse to provide the service.
36
License Q&A - 3
The device had been installed with 15 days platform trial license on August 1. Customer powered on and
tested the device on September 1 (The device was out of box on this day). Did customer need to apply for
additional platform trial license?
No need. The trial license only counts the time the device is powered on.
If the customer only has very limited and specified advanced security service requirement, for example, IPS, you
can just offer IPS license. Normally it is much more cost effective to use BDL if more than 2 licenses are needed.
37
License Q&A - 4
What is the lead time required to get the licenses, both actual and trial licenses?
q The trial related licenses can be generated by local system engineers, it can be available within one business
day.
q The production and formal licenses will be delivered by regional sales or sales assistant via email. Due to
different transportation time for the device to arrive in different region, please initiate the license request via
email, it normally takes two business days to deliver the licenses.
After upload the license, there will be message that may need you to reboot the device. Please do so and you will
see the newly installed license take effect.
38
License Q&A - 5
What is the start date of the actual license?
Hillstone licenses don’t have the ‘start date’ embedded. For the licenses that may expire, it either has the
expiration date or time period embedded. Since It takes time for the device to arrive and be installed after the PO
is placed, it is advised that in the PO, the partner states the date the device will be actually deployed and
activated. This way, Hillstone sales and sale assistant can request operation team to generate license with proper
expiration date.
For example, if the partner placed the PO on April 15, 2017, for the hardware to have 3-Year Warranty service. But
the device will only be activated by June 15, 2017. The partner can indicate it in the PO, so that Hillstone will
generate the platform license with the expiration date of June 15, 2020, rather than April 15, 2020.
39
License Q&A - 6
Can I delete the old platform trial license after I load the new trial license?
During the course of the trial, please NEVER delete the old trial licenses, unless you receive the formal production
platform license. The timer in the hardware will count the time period the device in power up mode, and the timer
will not reset itself with each trial license.
For example, a brand new device will have the power-on timer of 0 to start. After load a 15 days trial license, and it
runs for 15 days when the 1st trial license expires, the timer has the value of 15 days.
When the 2nd 10-day trial license is loaded, the firmware will add the time period from all trial licenses, which will
be 25, and compare it to the power-on timer, which is 15. Since 25 > 15, the trial can go on.
If the 1st trial license of 15-day is deleted, and the 2nd 10-day trial license is loaded, the system will add the time
period from all trial license, which will be only 10, and compare it to the power-on timer, which is already 15. Since
10 < 15, the system will think there is no valid trial license and it will stop the trial.
40
License Q&A - 7
Do we need license to renew warranty? What’s renewal within warranty and warranty expired?
Yes, for any of the product warranty renew, there is always need to have a new license and install it. For example,
for a E2800, with 1-Y warranty and 1-Y BDL1 subscription service, assuming the original warranty and BDL1
service licenses expire on July 15, 2017, it is highly suggested to have the service renewed before July 15, 2017
(PO before that date), the renewal PO will need two SKUs
SGSV-E2800-IN-12U: SG-6000-E2800 1-year basic hardware warranty, 1-year application database update and
software update services. And BDL1-E2800-IN12: StoneOS BDL1 Subscription Bundle
Two sets licenses will be issued with the renewal PO, one is new platform license, the other is the BDL1
subscription licenses. Both will with the new expiration date of July 15, 2018.
But if the renewal PO is place after July 15, 2017, for example, on October 25, 2017, the PO will need two SKUs:
SGSV-E2800-IN-12R :SG-6000-E2800 1-year basic hardware warranty, 1-year application database update and
software update services warranty expired. And BDL1-E2800-IN12: StoneOS BDL1 Subscription Bundle
The same sets of licenses will be issued, but these licenses will have the expiration date of October 25, 2018. The
SGSV-E2800-IN-12R is more expensive than SGSV-E2800-IN-12U
41
+1 408 508 6750
inquiry@hillstonenet.com
5201 Great America Pkwy, #420
Santa Clara, CA 95054
www.hillstonenet.com
42