Documentation
Licenses & entitlements
Documents the current release. We keep improving the platform, so some details may change. Ask support if anything looks off.
A NetEnds license is a single file, verified entirely on your host against public keys built into the release. Licensing makes no network request of its own. This page covers how to get and apply a license, what happens as it approaches and passes its term, how devices are counted, and what each tier unlocks.
What a license is
Your license is one .nelic file: a signed set of claims — your term dates, your licensed device count, your tiers, and any renewal grace NetEnds granted you — bound to your installation. Because it is checked offline:
- The file is tamper-evident. Any change to it breaks the signature, and a file that fails verification can never grant more than it was signed for — at worst it drops the install to base monitoring (below).
- It is node-locked: the license names the installation or installations it is valid on, so a file issued for one install does nothing on another.
Getting and applying a license
Licenses are managed on the License page, which sits in the sidebar below Settings and needs the platform administrator permission. The evaluation and expiry banners link to it too. Your Installation ID is shown there with a copy button, including during the evaluation.
To buy or renew:
- Copy your Installation ID and email it to sales@netends.com with your request.
- NetEnds issues a
.nelicfile bound to that ID and sends it to you. There are no public download links — the file is delivered on request. - On the License page, click Choose license file and pick the file.
The upload verifies first and replaces the stored license only on success. A tampered file, or one issued for a different installation, is rejected with a specific message, and your current license stays untouched. The new terms take effect at once in the process that handled the upload and everywhere else within about ten seconds — no restart and no data loss.
Renewing is the same upload, and it is also how an install that has already expired recovers: upload the renewal and everything resumes. Two uploads are refused so you cannot block yourself by accident:
- A license whose term has not started yet. Upload it on or after its start date.
- An evaluation license on an install that has held a paid license. An evaluation license stops the platform at its end date, so it is refused there; upload your subscription license instead.
Moving to new hardware
Reinstalling on the same host keeps the same Installation ID, so the license you hold still matches: re-upload the same file and everything resumes. The ID is kept in /var/lib/netends/install-state/install-identity, outside Docker — back that file up with the host. Rebuilding a host without it, and without restoring the database, creates a new Installation ID. When you move to new hardware or restore after a disaster, send NetEnds both the old and the new Installation ID; the replacement license covers both, so the cutover needs no downtime.
The evaluation
A fresh install with no license runs a 14-day evaluation from first boot: every tier, up to 5 devices, with no key to enter and no activation. A countdown shows in the product.
At the end of the 14 days the evaluation stops: the platform pauses until you apply a purchased license. Your data is never deleted — the inventory, topology and history you collected are all kept, and the on-screen message says so. Uploading a license resumes everything within seconds.
Evaluating more than 5 devices? Ask sales@netends.com for an evaluation license sized to your pilot. It is verified offline like any other license, and when it ends the platform stops the same way the built-in evaluation does.
The evaluation is one-time. Reinstalling on the same host resumes the same clock rather than starting a new one. Once a paid license has been installed, the evaluation does not come back, even after a reinstall: until the license is uploaded again, the platform runs base monitoring.
License states, and what happens at expiry
The state follows from your signed term dates and the clock:
| State | When | Platform paused? |
|---|---|---|
| Evaluation | No license yet, inside the 14 days | No |
| Evaluation ended | The 14 days elapsed on a never-licensed install, or an evaluation license passed its end date | Yes |
| Not verifiable | A license that fails verification, or was issued for a different installation | No — base monitoring only, up to 5 devices |
| Not yet valid | Before the license’s start date | Yes |
| Valid | In term, more than 30 days remaining | No |
| Expiring | In term, 30 days or fewer remaining | No — a banner counts down |
| Grace | Past the end date, inside the grace window NetEnds granted | No — a red banner |
| Expired | Past the end date and any grace | Yes |
Your end date is inclusive: the platform is fully licensed through the end of that day (UTC).
Grace is set per license when it is issued; it is not a platform default. Unless your license was issued with grace, the end date is a hard stop. During grace the platform works fully, with a red banner and the date service ends.
A license that fails verification — edited, corrupted, signed with a key this release does not recognize, or issued for a different Installation ID — does not pause you and does not unlock anything extra. The install drops to base monitoring, up to 5 devices, and shows the error, so the fix is clear: re-upload the original file, or request one issued for this Installation ID. Tampering can only ever lose capacity, never gain it.
What “paused” means
When the platform is paused (evaluation ended, not yet valid, or expired), it waits for a valid license: the API refuses requests, polling and discovery stop, notifications stop, inbound traps are dropped, and streaming and synthetic tests pause. Two things stay true while paused:
- Your data is never deleted. A pause is not a wipe.
- Sign-in and the License page keep working, so you can always upload a renewal to recover. An internal error never turns into a false “expired”: if the license state cannot be read, the last known state stays in force.
How devices are counted
Your cap counts nodes under management — firewalls, switches, routers, load balancers and access points whose status is active, unreachable or in maintenance. Synthetic test targets, pending discovery results and decommissioned nodes do not count.
- A seat is taken when a node is onboarded — added directly, or confirmed from discovery.
- Onboarding past your cap is refused with a message naming the count and the fix. Automatic onboarding, such as access points found through a controller, skips the extra nodes and logs it rather than failing.
- It is never punitive. If you move to a smaller cap, nodes already onboarded keep being monitored; only new onboarding is refused until seats free up or you apply a larger license.
Tiers and what they unlock
A license carries one or more tiers. There are three, and each includes everything below it:
| Tier | Unlocks |
|---|---|
| Base | Node inventory, monitoring and alerting, topology, and configuration backup and management. Syslog and SNMP traps are received and stored at this tier. |
| Events & flows | Searching and analyzing that event history — log search, flow analysis and event analytics — and writing your own syslog-pattern alert rules. |
| Gia | Gia, your network assistant — chat in the product and over the Slack direct-message bridge, its knowledge base and its daily digest — plus the Lab. |
Two reasons a feature might not appear
If something is not where you expect it, the cause is one of two, and they have different fixes:
- A padlock on a visible menu item means the feature exists but your license does not include its tier. Apply a license with that tier to unlock it. The API answers such a request with a
403markedentitlement_required, so the product shows an upgrade prompt rather than a permissions error. - A menu item that is not there at all means your user role lacks permission for it. That is role-based access control, set by your administrator, and has nothing to do with your license.
Naming which one you see — “the menu has a padlock” or “the menu item isn’t there” — gets you the right answer faster.
What licensing sends over the network
License verification makes no network request: the signature is checked against keys built into the release. Your Installation ID leaves the host only when you copy it and send it yourself.
That covers licensing. What the rest of NetEnds sends from your network, and when, is listed connection by connection on the Security page.