Forcepoint NGFW and FlexEdge SD-WAN licensing covers Forcepoint’s network security products: the Next-Generation Firewall (NGFW) engines, the Security Management Center (SMC) that manages them, and the FlexEdge Secure SD-WAN appliance bundles. They are licensed under the Network Security Products License Agreement (Network Security EULA), whose Forcepoint counterparty is Forcepoint Quarry Solutions LLC or Forcepoint Quarry Solutions Limited.[1]
The agreement’s “License” is “the limited, personal, non-sublicensable, non-exclusive, nontransferable right to use the Software (including the Database) during the License Term”, used together with the Hardware where an Order includes it.[1] Forcepoint grants a License and, where applicable, a Subscription to the Software and to Software Upgrades provided under Maintenance. It also grants a Subscription to Cloud Services, each “solely for Licensee’s internal business purposes up to the Permitted Capacity”.[1] Catalog proof: Network Security License and Maintenance.
Editions
FlexEdge Secure SD-WAN bundles. Each FlexEdge Secure SD-WAN bundle contains:[2]
- one appliance Unit;
- one Node of FlexEdge Secure SD-WAN Manager;
- 12 months of Essential Support, unless the quotation includes Enhanced or Enterprise Support;
- the Advanced RMA limited warranty during the Subscription Term;
- one of two software packages, listed on the quotation.
Models listed in the Rider run from S60 and S60L through S120, S352, S355, S1202, S2201, S2205, S2210, S3401, S3405 and S3410.[2]
| Software package | Contents (each 1 Node per 12 months) |
|---|---|
| Connectivity and Access (CS) | SD-WAN functionality; base Layer-7 firewall |
| Connectivity and Access & Threat Inspection (CTS) | CS plus Intrusion Prevention, TLS Encryption, QUIC Inspection, AV and Threat Seeker Cloud URL filtering |
Source for the table: Solution Rider.[2]
Feature packs and management services. The Advanced Malware Detection and Protection sandbox is “available as a feature pack” with NGFW, in sizes S, M, L, XL and XXL. The Security Management Center Service (SMCaaS) is a cloud-hosted SMC sold in XS and S sizes.[2] The retired Edge Advantage bundle listed SMC, SMC High Availability, SMC Domains, the SMC Additional Log Server, the NGFW Software Subscription and NGFW URL Filtering, each per Node.[2]
Metrics
The Network Security EULA treats Device and Node as one metric: “any kind of computer, electronic appliance, or device capable of processing data”. It adds that “In the case of a virtual system, each virtual machine or instance running the Product is a Device or Node.”[1] Hardware is counted by Unit: “a single instance of computer hardware purchased from Forcepoint as described in the Order”.[1] Permitted Capacity in this agreement may be Devices, Units, Nodes, Throughput, Users or other metrics.[1]
In the product itself, licences are files held by the Management Server. “Generally, each SMC server and each Firewall, IPS, Layer 2 Firewall, and Master NGFW Engine node must be separately licensed in your SMC.”[3] Catalog proof: NGFW Engine node license; Each SMC server and NGFW Engine node needs a licence.
Counting / floors
Licence binding (installation guide, 2023-08-25). Four binding methods exist:[4]
| Component | Licence binding |
|---|---|
| Management Server | Static IP-address-bound or UIID-bound licence |
| Log Server, Web Portal Server | IP address, UIID, or dynamic licence bound to the Management Server proof-of-license (POL) code |
| Pre-installed NGFW appliances | Appliance proof-of-serial (POS) code (current models) or POL code (older models) |
| NGFW Engines on own hardware or virtualization platforms | Always a dynamic licence bound to the Management Server POL code |
| Feature-specific licences | POL code or POS code, depending on the feature |
Source for the table: installation guide, “Types of licenses for SMC servers and NGFW Engines”.[4] POL-bound licences “are valid only for components that are managed by the Management Server that has the same POL code”. A licence of this kind cannot be used with a different SMC.[4] The installation guide also notes that “The Management Server’s license might be limited to managing only a specific number of NGFW Engines”. An appliance that cannot reach the License Center “can be used without a license for 30 days”.[4] Catalog proof: Virtual and own-hardware NGFW Engines use POL-bound licences.
Feature-pack caps (Solution Rider, 06/26). The NGFW sandbox feature pack limits the files sent for analysis each month per appliance Unit to a File Maximum: 3,000 (S), 9,000 (M), 15,000 (L), 30,000 (XL) or 60,000 (XXL). Each SMCaaS instance may manage up to 10 NGFW Units (XS) or 20 (S). Above that, Forcepoint may terminate on 30 days’ notice unless more capacity is bought.[2] Catalog proof: NGFW sandbox files are capped per appliance Unit; SMCaaS manages a fixed number of NGFW Units.
Overage. Use may “in no event exceed the authorized Permitted Capacity”. Excess requires buying “additional Permitted Capacity and Maintenance sufficient, including for the balance of the then-current License Term, Subscription Term, and Maintenance Term”.[1]
Virtualization & partitioning
“Virtual NGFW Engines do not require their own licenses.”[3] Instead, “the Master NGFW Engine license limits the number of Virtual Resources that can be created”, and that limit sets how many Virtual NGFW Engines can exist.[4] NGFW Engines installed on a hypervisor are not virtual contexts. They are Engine nodes with a POL-bound licence each.[4] An SMC Appliance installed from the ISO onto a virtual machine or non-Forcepoint hardware needs an SMC licence that includes the “Forcepoint NGFW Security Management Center Virtual Appliance” feature pack.[4] Catalog proof: Each virtual machine running the Product is a Node.
Cloud / BYOL
Two AWS images are treated differently. Engines “deployed in the AWS cloud with the Bring Your Own License image must have a license in the SMC”. Engines from the “Hourly (pay as you go) image do not require” one.[4] For a licence position, BYOL cloud engines count like any other Engine node, while hourly engines are paid through the cloud marketplace.
Programs
- Maintenance. “Upon renewal, Maintenance must be purchased for each Product purchased and running in Licensee’s environment.”[1] If support expires before renewal, the licensee must also pay for the lapsed period. “In the event technical support has lapsed for one year or more, Forcepoint may charge a reinstatement fee.”[1] Licence upgrades depend on maintenance: “If the maintenance contract of a component expires, it is not possible to upgrade the license to any newer version.”[3] Catalog proof: Network Security Maintenance must cover every running Product at renewal; Lapsed network security support is back-charged, with reinstatement fees after a year.
- Term. “Upon expiration of the License Term, Licensee’s right to use the Products terminates.” A licence renewed after it expired must include License Fees for the lapsed period. Orders are non-cancellable, with no refunds for lower usage.[1] Catalog proof: Network Security licence use ends with the License Term.
- Evaluations. Evaluation subscriptions run for up to 30 days, and NGFW evaluation licences “are valid for 30 days”.[1][3]
- Hardware support. Network Security Hardware limited warranty support requires a valid support enrolment for the Hardware. It includes Advanced RMA: replacement with a new unit for dead-on-arrival defects reported in the first 90 days, and refurbished or equivalent units after that. Next Business Day, Next Business Day with Keep-the-Box, and Same Day support are paid upgrades.[5] Hardware title passes to the licensee on sale, but the software on it stays licensed.[1] Modules carry a 36-month limited warranty, mini modules and transceivers 12 months, and accessories 90 days.[2] Catalog proof: Hardware support requires a software subscription.
- Life cycle. When a new major NGFW release ships, “The version that is one Major Release back is retired and enters the End of Maintenance period”. Support and warranty for hardware can generally be bought for up to five years after the original purchase.[6]
- Verification. The Network Security EULA has the same verification clause as the Subscription Agreement. Additional License and Maintenance Fees are charged at “then-current list price without any discounts or prior pricing terms”.[1]
Out of scope
This article does not cover the legacy Sidewinder firewall, Forcepoint’s government cross-domain products, or appliance specifications. NGFW licence binding is taken from the 7.0 guides. Forcepoint publishes no public price list.[3]