Juniper Licensing - Stupid question of the day

[muttbarker_]

Ok - having spent over two hours on the phone with both JTAC technical support and JTAC customer care and getting no answers I decided I should ask the real experts this question. I hate licensing and don't have a good understanding of it and apparently neither does anyone in JTAC.

I recently bought a special MAG bundle from Juniper (for resellers only) that included the following two licenses:

ACCESSX600-ADD-100U

ACCESS-100U-3YR

My bundle also incuded 3 MAG units - one of which I am running as a license server, the other two will be in an A/P cluster. 

I learned a while back that you do not apply Secure Meeting licenses to a license server. They must be applied to the box that will run Secure Meeting. Based on that logic it would I would guess that I would apply the first license (ACCESSX600) to one of my two A/P units and that I could then apply the subsription license to the license server. My sales guys says I am wrong. That the ACCESSX600 is also appied to the license server for distribution to the A/P boxes. Is that correct?

I am also struggling a bit as to why I would have the second license (3YR) and what is does versus the regular ACCESSX600 license. Why would it be used? On this one my sales guy is also clueless.

Any help is appreciated.

[michael.saw_]

Erm..

There should be a MAG (with license-server license) acting as a license-server, and a MAG or SA (with license-member license) acting as a license-member.

Note that ACCESSX600-ADD-100U is a permanent license, but ACCESS-100U-3YR is subscription-based (perhaps for SA SSL VPN Virtual appliance)...

[filbert_ · Accepted solution]

I'm not sure why they would bundle those licenses together but here is what I know;

To run a MAG as a license server, first you'll need a License Server License. The Access licenses are just concurrent users.

You could then put the ACCESS-100U-3YR on your license server and allocate those licenses to the MAG A/P pair.

If you install the ACCESSX600-ADD-100U on the license server you'll need License Member Licenses on the MAG A/P pair. At least that is the way it works if you are not using subscription licenses on the license server. I'm not sure how it would work if you mix a subscription license and a x600 access license on the license server.

You could install the x600 license directly on one of the appliances in the A/P pair so you would have some dedicated licensing and some allocated from the license server. It should cobmine them for 200 users ont he A/P pair however I've never tried this.

In general the Accessx600-ADD-xxxU licenses can be installed on a license server and allocated to other MAG appliances as long as they have member license installed. Or they can be installed directly on a x600 appliance just as a regular license. In either case X600 licenses wil only work with MAG appliances. 

The Access-3Year license are primarliy meant to be installed only on a license server. With that license installed you can then allocated concurrent user amounts to ANY Juniper SSL-VPN appliance. This makes it nice for upgrading hardware because you don't need to purchase new licenses. You can also distribute a portion of the 100 users license to a SA4500, another portion to a MAG2600, etc.... The downside is the license expires in 3 years. These licenses were mainly developed for service providers.

The bottom line is you could do it either way. Though you would need to verify the "Member License" requirement on the A/P pair if you put the X600 license on the license server.

I hopes this helps.

[muttbarker_]

Thanks for the consise and informative explaination. Greatly appreciated.