License Management
The License page is where you view the installed licence, upload a new one, and see exactly which features are unlocked for this appliance.
The page lives at License in the sidebar (route /license). Anyone can view it. Only admins can upload or remove a licence.
The page is laid out top-to-bottom as: Installation ID, the current licence panel, an Upload panel (admins only), and a Help section.
Why the Appliance Has a Licence
Section titled “Why the Appliance Has a Licence”A licence is a signed file the vendor issues to you. It controls which features the appliance is allowed to run and for how long.
The appliance verifies the signature on every licence on every startup and re-checks periodically while running. A licence that fails verification — wrong signature, tampered payload, expired dates, wrong installation — does not unlock anything. The system keeps working in a degraded “no licence” state but most features are locked.
The two dates that matter:
| Date | What lapses when it passes |
|---|---|
| License Expires | For a Term licence, the appliance restricts itself to dashboards, live streams, and the licence pages until a renewed licence is uploaded; a Perpetual licence keeps running and shows an expired banner |
| Support Expires | The vendor’s support contract; the appliance keeps working but you cannot open new support sessions |
The licence expiry is the harder of the two. Once the licence expires the appliance refuses to run new analyses, accept new bulk actions, or extend automation; support expiry only affects your ability to reach a human at the vendor.
Licence Types and Tiers
Section titled “Licence Types and Tiers”Each licence has a type that controls how it behaves at expiry, and a tier that controls which features are unlocked.
| Type | Behaviour at expiry |
|---|---|
| Term | Time-limited. When License Expires passes, the appliance restricts itself to dashboards, live streams, and the licence pages until a renewed licence is uploaded |
| Perpetual | Never expires on its own. Intended for production deployments; renew only to extend support or change entitlements |
| Tier | Typical scope |
|---|---|
| Basic | Inspection and dashboard, no LLM, limited automation |
| Pro | Inspection + LLM analysis + automation, single-site |
| Enterprise | All features, larger lease counts, multi-site |
Tiers are settings on the issued licence, not modes you switch in the GUI. To change tier, contact the vendor and apply a new licence.
Installation ID Section
Section titled “Installation ID Section”The Installation ID is a unique identifier the appliance generated on first startup. You give it to the vendor when requesting a machine-bound licence.
The top card on the page shows:
- The Installation ID itself, shown in monospace.
- A Copy button that copies the ID to your clipboard and briefly shows a green tick.
If the ID is missing or blank, the appliance has not finished initialising — wait a minute and refresh. Once generated, the ID persists for the life of the installation and cannot be changed from the GUI.
See Installation Binding (chapter 38) for the full explanation of how this ID is derived, what it binds, and what happens if hardware changes.
Current Licence Panel
Section titled “Current Licence Panel”The middle of the page shows the installed licence with badges, dates, and a list of unlocked features. If nothing is installed, this panel says so.
When a licence is installed and valid:
- A green Valid License pill appears alongside the tier badge.
- A grid lays out the licence details:
| Field | What it shows |
|---|---|
| License ID | The licence identifier, shown in monospace |
| Customer | The customer name the licence was issued to |
| Description | Free-text notes the vendor put on the licence (optional) |
| License Expires | Date the licence becomes invalid |
| Days Remaining | Countdown to License Expires; colour-coded — green over 60 days, yellow over 30, orange over 7, red under 7 |
| Support Expires | Date the support contract ends; red when expired |
| Tier | The licence tier — Basic / Pro / Enterprise |
When a licence is installed but invalid, the green pill is replaced with a red License Expired pill and the warning is shown alongside.
When no licence is installed, the panel shows a yellow warning icon and a message: “No License Installed. Upload a valid license to unlock all system features.”
Licensed Features Row
Section titled “Licensed Features Row”A row of pills under the details grid spells out exactly which features are turned on.
The pills you may see:
| Pill | Meaning |
|---|---|
| IPv4 Processing | DHCPv4 inspection is enabled |
| IPv6 Processing | DHCPv6 inspection is enabled (see the IPv6 feature gate below) |
| N Users | Maximum concurrent users; “Unlimited Users” when no cap |
| N Leases | Maximum tracked unique MAC addresses in the rolling window; “Unlimited Leases” when no cap |
Each pill is rendered in green (IPv4 / IPv6) or primary blue (users / leases) so a quick glance tells you what is allowed without reading text.
The IPv6 Feature Gate
Section titled “The IPv6 Feature Gate”The IPv6 pill is the most visible feature gate on the page. It is a GUI-only restriction.
When the licence does not include IPv6, every GUI surface that would expose IPv6 information hides or disables itself: dashboard widgets in the IPv6 category disappear, filter pickers that include a protocol option drop the IPv6 choice, the packet capture builder removes its IPv6 filters, and IPv6-only stats panels show a “feature not licensed” empty state.
The underlying packet processor and NFTables rules are unaffected. If you upload a licence that turns IPv6 on later, the existing IPv6 traffic that was already being processed becomes visible in the GUI — no restart, no replay.
Customers with IPv4-only licences sometimes ask “why am I missing widgets?” — the answer is almost always the IPv6 gate. Check the Licensed Features row first.
Remove Licence Button
Section titled “Remove Licence Button”Admins see a red Remove License button at the bottom of the panel. Use it before re-uploading a replacement.
Removing a licence drops the appliance into the unlicensed state immediately — most features lock. A confirmation prompt warns about this before the deletion happens. There is no “undo”: you must upload a valid licence (the same one or a new one) to restore service.
Upload Panel
Section titled “Upload Panel”Admins see an Upload New License panel below the current licence. Use it to install a new licence or replace an existing one.
There are two ways to provide the licence content:
- Paste License Key — paste the licence text directly into the textarea.
- Upload License File — pick a
.lic,.txt, or.keyfile from disk; its contents are loaded into the textarea automatically.
Either way, press Apply License. The appliance verifies the signature, checks the binding, and writes the licence to its licence store. On success a green “License uploaded successfully!” banner appears, the current licence panel refreshes with the new details, and any feature gates change immediately.
Binding Errors
Section titled “Binding Errors”If you upload a licence that was issued for a different installation, the page shows a clear binding-error panel instead of a generic upload error.
The panel is bordered in red and contains:
- A heading “License Binding Error”.
- The specific error returned by the verifier.
- A reminder to contact the vendor and provide the Installation ID shown at the top of the page.
- A Dismiss button to clear the message.
The previous licence (if any) is left in place when an upload fails — your appliance does not drop into an unlicensed state because you tried the wrong licence. See Installation Binding (chapter 38) for how binding works and what to do when it goes wrong.
Other Upload Failures
Section titled “Other Upload Failures”Other failures surface as red banners in the message area: signature invalid, payload malformed, dates in the past at upload time, file too large. Fix the licence file (or request a fresh one) and try again.
Expiration Warnings
Section titled “Expiration Warnings”The appliance starts warning you about an upcoming licence expiry well before the licence actually lapses.
The licence carries a “warning days before” value (typically 30). When Days Remaining drops below that threshold:
- The licence header on this page colours the day counter red.
- A warning banner appears at the top of every page in the GUI: “License expires in N days” — or “License expires tomorrow” / “License expires today” as the date approaches.
- The system raises a
system:license:expiringalarm so it shows up in the Alarms (chapter 11) feed and any notification rules you have wired.
When the licence has actually expired:
- The licence pill flips to red License Expired.
- A
system:license:expiredalarm fires. - Licensed features stop working until a new licence is uploaded.
The warning window is your renewal cue. Schedule renewal before the warning fires, not after — a lapsed licence interrupts production.
Renewal Flow
Section titled “Renewal Flow”Renewing a licence is “request, upload, done.” There is no migration step.
- Request the renewal. Contact the vendor with your customer name, the licence ID shown on this page, and the Installation ID from the top of the page. For a bound renewal the Installation ID is required.
- Receive the new licence text or file from the vendor — usually a signed
.licfile or a base64 string in an email. - Upload it. Paste it into the textarea (or use the file picker), then Apply License. The new licence overwrites the old one in the licence store.
- Confirm the change. The current licence panel refreshes with the new dates. The expiry warning banner clears. Any features that had locked re-enable.
You do not need to restart the appliance, drain traffic, or coordinate with users. Uploading a fresh licence is a hot replacement.
Renewing before expiry: the new licence’s date range simply replaces the old range. There is no “join two licences” mechanic.
Renewing after expiry: the same flow applies. The system was running unlicensed while you were waiting; uploading the new licence unlocks features again immediately.
Feature Gating in Practice
Section titled “Feature Gating in Practice”A licence gates features at three different layers — each with a slightly different “what happens when this is off” behaviour.
| Layer | Examples | Behaviour when gated off |
|---|---|---|
| Protocol | IPv6 Processing | GUI surfaces hide; processor and NFTables unaffected |
| Capability | Automation, LLM Analysis, Strategic Analysis | Backend features refuse to run; GUI shows “not licensed” empty states |
| Quantity | Users, Leases | Soft warning when within 20% of the cap; alarm when exceeded |
Quantity caps use a 20% tolerance buffer before declaring “exceeded” so a brief spike does not trigger a warning. The active lease count is measured over a rolling 7-day window of unique MAC addresses.
When in doubt about what is and is not enabled, the Licensed Features row on this page is the authoritative list. Other pages reflect the same source of truth.
Help Section
Section titled “Help Section”A short reminder at the bottom of the page: licences come from your administrator or sales contact, and renewals or upgrades go through support.
There is no “buy now” or “self-serve renewal” button. All licence transactions are mediated by the vendor.
Related
Section titled “Related”- Installation Binding (chapter 38) — what the Installation ID is, how it is derived, and how binding errors are resolved.
- Support Backchannel (chapter 34) — support entitlement is tied to Support Expires on this page.
- Alarms (chapter 11) — licence expiry warnings and breaches surface as alarms.
- Architecture (chapter 1) — for the broader picture of what the appliance does once a licence is in place.