Description

On SRX and vSRX devices, the idp-sig and appid-sig licenses are installed and configured, and appear to be working. However, the firewall shows them as not used. This article explains how the "Licenses used" counter is updated and when the firewall shows the licenses as not used.

 

Symptoms

The output from show system license displays that the Intrusion Detection and Prevention (IDP) feature is installed. However, the "Licenses used" column displays a value of zero for the IDP feature:

Root> show system license
License usage:

Feature name       Licenses used  Licenses installed   Licenses needed   Expiry
idp-sig             0              1                    0                 2017-09-06 01:00:00 BST
appid-sig           0               1                    0                 2017-09-06 01:00:00 BST
VirtualAppliance    1              1                    0                 2017-09-06 01:00:00 BST

 

Solution

The "Licenses used" column is relevant to commands where configurations need a license, so when a configuration is performed or removed, the "Licenses used" counter is updated.

However, the IDP license is not for the entire IDP feature, but for the IDP security package installation.

The idp-sig license is checked for the following security-package-installation-related configuration commands: 

set security idp security-package install <..>
set security idp security-package url <..>
set security idp security-package automatic <..>
set security idp security-package source-address <..>

Similarly, the appfw license is checked for the following configuration commands: 

set services application-identification download automatic start-time <start-time>
set services application-identification download automatic interval <interval>

When these commands are configured, the "Licenses used" column will display 1. When these commands are removed, the column will display 0.

The idp-sig/appid-sig license is also checked for the action command, request security idp security-package install . However, this is not a configuration command. There is no concept of "feature-currently-configured" here; therefore, "Licenses used" is not relevant in this case.

For all other IDP-related commands, an idp-sig license is not needed. Hence, "Licenses used" will be 0 in those cases. Use the command show security policies or show security idp status to verify that IDP is in use.

 

Modification History

2018-06-19: Added the set services application-identification CLI commands for the appfw license in the Solution section. Made other minor modifications