Skip to main content
tiCrypt

Global Licensing Servers

AdministratorRequires: Super-admin role. No permission grants access to this table.

A global licensing server is an allowlist entry that lets every tiCrypt VM reach one server on the listed ports and protocol. tiCrypt VMs have no outbound network access, so software inside a VM cannot reach a license server, a Windows KMS host or any other service on your network until an entry opens the path. For example, Windows VMs need an entry for the KMS host, and Windows VMs used over Remote Desktop need one for the RD license server.

A global licensing server is not a VM access rule. A global entry applies to every VM in the deployment for as long as it is active. A VM access rule applies only to the VMs of the VM configurations it names, and can be limited in time.

Why global licensing servers exist​

  • Some servers serve every VM: a Windows KMS host or a Remote Desktop license server is needed by every Windows VM, whoever starts it. One global entry covers them all, including VMs of VM configurations created later.
  • The path stays narrow: an entry opens one server, one protocol and only the listed ports. Every other destination stays blocked.
  • Only Super-admins decide: every outbound path is a path data can leave by, so tiCrypt accepts requests to view, register, edit and delete entries only from Super-admins. The View, Create, Edit and Delete global licensing servers permissions do not give access to this table. See Permissions.
note

Entries take effect only when the tiCrypt backend applies them: licensing-server-driver set to firewalld, or nft.enabled set to true, in the tiCrypt VM service configuration. With the defaults, entries are saved but VMs still cannot reach the servers.

When to use a global licensing server​

  • Every VM needs the server in every session: register a global licensing server.
  • Only some VM configurations need the server, or only for a task: create a VM access rule instead.
  • The goal is moving data into tiCrypt: use the Vault, an inbox or an SFTP connection rather than a network path.

Before you begin​

  • You are a Super-admin.
  • You know the server's domain name or IPv4 address, and the ports and protocol the software uses. Check the software vendor's documentation; for example, Windows KMS and RD licensing both use TCP.

Access the Global Licensing Servers​

  1. Go to the Management icon in the top left taskbar.
  2. Navigate to the Virtual Machines section.
  3. Click Global Licensing Servers in the left panel.

The following table describes the columns of the Global Licensing Servers table.

ColumnContent
ServerThe domain name or IPv4 address of the server.
PortsThe ports and port ranges, such as 1688, 27000-27010.
Protocoltcp or udp.
ActiveWhether the entry applies.
GroupThe optional group label.
DeactivationThe date the entry stops applying, if any.
Created byThe Super-admin who registered the entry.
CreatedWhen the entry was registered.

View the Basic Information of a Global Licensing Server​

Location: Management > Virtual Machines > Global Licensing Servers

  1. Select the global licensing server.
  2. Click the View button in the top right panel.
  3. In the left panel, under Basic info, view the server, ports, protocol, active status, deactivation date ("Never" when none is set), owner, group, creation date and ID.

Register a Global Licensing Server​

Location: Management > Virtual Machines > Global Licensing Servers

  1. Click the Create global licensing server button in the top right panel.
  2. In the Register a new global licensing server pop-up, under Server, enter the domain name or IPv4 address of the server, such as license.example.com or 10.0.0.5.
  3. Under Ports, enter at least one port or port range, such as 1688 or 27000-27010. Type a comma or press Enter after each one. Ports are whole numbers from 1 to 65,535.
  4. Under Protocol, select TCP or UDP.
  5. Optionally, under Group (optional), type a group name or pick an existing group from the suggestions.
  6. Optionally, under Deactivate on (optional), choose the date the entry stops applying: any day from tomorrow on. Leave it empty for servers that VMs always need.
  7. Click Register global licensing server.
Result:

A task named "Register global licensing server server (ports)" registers the entry, and tiCrypt updates the VM network rules right away. The new entry is active.

A range stays one range: 8000-8010 is saved as one entry, not as eleven ports. Ports and ranges that overlap or follow each other are combined, so 1, 2, 3 becomes 1-3 and 80, 80-90 becomes 80-90. If a port or range is not valid, such as 70000 or 8010-8000, the error shows under Ports and the register button stays inactive.

note
  • Each entry has one protocol. A server that needs both TCP and UDP takes two entries.
  • Groups are labels that help you sort and find related entries. They do not change which VMs can reach the server.
  • Open only the ports the software needs. Every entry applies to all VMs.

Edit a Global Licensing Server​

Editing changes an entry in place, so the server keeps its history and its creator.

Location: Management > Virtual Machines > Global Licensing Servers

  1. Select one global licensing server.
  2. Click the Edit button in the top right panel.
  3. In the Update global licensing server: server pop-up, change any of Server, Ports, Protocol, Group (optional) and Deactivate on (optional).
  4. Under Status, select Active for the entry to apply, or Inactive to keep it without opening the path.
  5. Click Update global licensing server.
Result:

A task named "Update global licensing server server" saves the entry, and tiCrypt updates the VM network rules right away.

An entry whose range is stored as single ports shows the range again in the form, and saving it stores the range as one entry. To remove the deactivation date, clear Deactivate on (optional). A date already set before today stays selectable when you edit the entry.

Re-Sync Global Rules​

bulk-action

Location: Management > Virtual Machines > Global Licensing Servers

  1. Click the Re-sync global rules button in the top right panel.

Registering, editing or deleting an entry updates the VM network rules right away. Re-sync global rules rewrites the rules from all active entries. Use it when VMs cannot reach a server that has a correct, active entry.

Refresh the Global Licensing Servers​

bulk-action

Location: Management > Virtual Machines > Global Licensing Servers

  1. Click the Refresh button in the top right panel.

Delete Global Licensing Servers​

bulk-action

Location: Management > Virtual Machines > Global Licensing Servers

  1. Select the global licensing server(s) to delete.
  2. Click the Delete button in the top right panel.
  3. In the prompt, click Delete global licensing servers.
VMs lose access to the server

Deleting a global licensing server removes it from the system: "VMs will no longer be able to access this global licensing server." Software that depends on it loses license access. To stop the access for a while, edit the entry and set it to Inactive instead.

Related