FireSight OT licenses

FireSight OT (a Cloud Hub and its Cloud Connectors) is licensed through this same portal, with the same keys and license files as FireSight. Systems, licenses and downloads show which product they are for, and FireSight OT counts Cloud Connectors instead of firewalls.

Two kinds of license

	Hub license	Device license
For	A company that runs a Cloud Hub	One Cloud Connector, for example a device sold with a subscription
Bound to	The Hub (its serial, `OT-XXXX-XXXX-XXXX`, and hardware)	The connector's serial (`CC-XXXX-XXXX-XXXX`), which survives re-flashing
Covers	A number of Cloud Connectors	Exactly one Cloud Connector, on any Hub
Installed	On the Hub's License page, or `fsot-hub license install`	On the Hub, or on the device (`license=` in `firesight.txt`, or `fsot-connector set license`)

License a Cloud Hub

On the Hub, open License and download the activation request.
In the portal, upload it under Register a system, like a FireSight activation request. The portal recognises it as a Cloud Hub and records its customers and connectors.
Ask for a license on the Hub's page, or your reseller or FireSight issues one.
Download the .lic file and install it on the Hub.

On a shared Hub, a license can be meant for one of the Hub's customers. Whoever issues it fills in For a customer on this Hub, and the Hub's administrator assigns it to that customer on the Hub's License page.

Register and license Cloud Connectors

Cloud Connectors are registered by the serial on their label (also shown by fsot-connector status), usually when they're made or sold. FireSight staff, or the customer's reseller, enter one serial per line under Register Cloud Connectors on the customer's page. A serial belongs to one customer.

Each connector then has its own page, where a device license is issued. The customer downloads the .lic file from the portal, or it ships on the device. When a Hub reports a registered connector, its page shows which Hub it's on.

Which license covers a connector

The Hub decides, oldest connector first: a device license for that connector, then a Hub license meant for the connector's customer that still has room, then any other Hub license with room, then the evaluation.

Evaluation, grace and what stops

A new Hub runs as a 30-day evaluation for up to 3 Cloud Connectors. A connector that isn't covered (over the count, expired, or after the evaluation) has 30 days of grace. After that, new user sessions through that connector are refused: web pages, client tunnels, port forwards and VPN routes. Covered connectors aren't affected.

Remote management, status, diagnostics, software updates, certificate renewal, file storage and installing a new license never stop, so a lapsed license never strands a device.

Resellers

A reseller's allowance has separate amounts for FireSight firewalls and FireSight OT Cloud Connectors, and a device license uses one connector from it.

Online renewal

A Hub or connector can fetch its current license from license.firesightsystems.com once a day, if its owner turns online renewal on. It sends the license ID, its install ID or device serial, the number of connectors in use and its version, and gets back the current signed copy.