License Management

There are three licensing models, network devices, public cloud infrastructures, and endpoints.

Please contact your sales representative or Forward Support with license questions or issues.

Network Device Licensing

Forward implements a subscription model in which the unit is the network device. Each Forward Enterprise license covers a specified number of network devices for a designated period (typically one year).

The Forward licensing model privileges simplicity; in fact, it considers all network devices to be created equal. The licensing model does not differentiate between a Top-of-Rack (ToR) switch and a high-end Service Provider router.

When the license expires, none of the existing data will be deleted or made unavailable because of license expiration. However, the users won’t be able to gather or generate any new data about the network; specifically, the user won’t be able to:

• Create new networks.
• Collect new snapshots for existing networks.
• Create new verification policies.
• Create new aliases.
• Etc...

Users can still run search and path analysis queries on existing snapshots.

To configure license notification, please visit the notification page.

Special Cases

The following are some described special cases.

Virtual Devices or Contexts

In the case of virtual devices or contexts, each device, context (or domain), and tenant consumes a license.

Examples of virtual contexts that require a license are:

Products	License Counter Scope	FN Licensing
A10 - multi-tenancy	Number of Tenants	One license count for each tenant
Aruba	Number of Controllers	One license count for each controller
Avaya	Number of devices	One license count for each controller
Cisco - Routers and Switches	Number of devices	One license count per device (physical and/or virtual)
Cisco - Nexus 7000 VDC	Number of VDCs	One license count per (Virtual Device Context)
Cisco - Viptela	Number of Controllers (vManage, vSmart)	One license count for each vEdge and one license for the underlying IOS-XE device
Cisco - ACI	Number of Controllers (APIC)	One license for each fabric node and one license for the controller
F5	Number of VE, vCMP & hardware count	One license count for each vCMP and hardware piece
Palo Alto Networks	Number of vSYS	One license count for each vSYS
Vmware - AVI	Number of Controllers	One license count per device (physical and/or virtual)

High-Availability (HA)

Many platforms provide High-availability (HA) options to minimize downtime and ensure continuous operation even during failures or disruptions.

Usually, each device in an HA pair/cluster has its own unique management IP address, which means that every device in an HA pair/cluster consumes a license.

Examples of such HA platforms are:

• Cisco ASA Active/Standby failover
• F5 Networks' BIG-IP device clustering
• Palo Alto Networks High Availability (HA)

Stackable Switches and Virtual Switching Systems (VSS)

Stackable switches, such as the Cisco Catalyst 3650 and 9200 Series, operate as a single logical unit. Similarly, a Cisco Virtual Switching System (VSS) combines two physical Cisco Catalyst switches into a single virtual switch.

Consequently, a stack of switches or a VSS consumes a single license.

VMware vCenter

When collecting from a VMware vCenter instance, each ESXi server (the physical servers running the ESXi hypervisor) consumes one license. However, the virtual machines (VMs) and vSwitches running within the ESXi server do not consume additional licenses.

Wireless

When collecting from a wireless deployment, both WLAN controllers and Access Points (APs) consume licenses.

The number of required licenses will depend on the total number of controllers and access points in the network.

License Consumption

A license is considered utilized when Forward successfully collects data from a device.

To see the devices currently consuming licenses, navigate to Settings > System > License > Network devices:

The Overview section at the top summarizes the number of purchased and used licenses.

The Licensed devices section lists all licensed devices, their networks, the timestamps of their last snapshots, and status.

Device Auto Decommissioning

Devices are automatically decommissioned after 7 days since their last successful collection. This means that they no longer consume a device license once decommissioned.

Device Deduplication

Forward Enterprise allows Org Admins to partition the network infrastructure into different Networks. These networks may partially overlap, meaning a device or a group of devices could be part of multiple networks. The license unit is based on a unique device's signature, so a device will only be counted once, regardless of the number of networks it belongs to.

Cloud Licensing

Forward licensing for cloud environments follows a credit consumption model based on Cloud Credit Hours (CCH).

A CCH represents an hour of modeling of the cloud network infrastructure per compute instance (Amazon EC2, Microsoft Azure VM, Google GCP instance) discovered within the target cloud environment.

Forward keeps track of the running compute instances in each cloud account every time a new Snapshot is taken, and then translates the usage to CCH and decrements the CCH available.

The information regarding cloud licensing is available in the Cloud credit hours tab.

The Overview section at the top of the page summarizes the total purchased credit hours, used credit hours, and available credit hours.

warning

Unused Cloud Credit Hours will expire at the end of the subscription period.

The Cloud credit hours consumption section provides more details on VMs modeled by Forward and Cloud credit hours.

VMs

Shows Modeled and Inferred VMs (Compute Instances) current and historical count data.

What Are Inferred Instances?

An inferred instance is a compute instance—such as an Amazon EC2 instance, an Azure VM, or a Google Compute Engine instance—that Forward Networks can identify indirectly, even if it is not discovered through direct collection. For example, if a load balancer in a collected account is configured to forward traffic to backend instances in another account, subscription, or project, Forward Networks can trace references through the load balancer and infer the presence of those backend instances.

Why They Matter: Inferred instances are included so that you always get a complete and accurate view of your environment. By accounting for both directly modeled and indirectly inferred instances, Forward Networks ensures that all reachable infrastructure is represented in your model and available for path analysis.

Cloud Credit Hours

Shows available credit hours, total purchased credit hours, total available credit hours, and related trends. If you buy more than one license, every license will be shown with a different color in the charts.

Forward Networks licenses Cloud Credit Hours (CCHs) for all compute instances that are reachable within your environment. This includes both modeled instances (directly discovered in collected accounts, subscriptions, or projects) and inferred instances. This approach provides comprehensive coverage of your cloud infrastructure, enabling full visibility and precise network analysis.

note

The system will show a banner like the one below when more than 90% of the available cloud credit hours have been used.

Grace Period

If you exceed your licensed Cloud Credit Hours (CCH), Forward provides a 90-day grace period to ensure uninterrupted cloud data collection. During this period:

• Cloud collection continues seamlessly for up to 90 days, or until your cloud license expires—whichever comes first.
• Any credit hours used during the grace period will be charged against your next cloud license.

This grace period gives you time to renew or adjust your licensing needs without disrupting visibility into your cloud infrastructure.

Endpoint Licensing

Endpoint licenses enable data collection from discovered endpoints. A license is consumed only when an endpoint is collected. Discovered endpoints that are not collected will not consume a license.

Before purchasing and activating an endpoint license, you can collect from up to 10 endpoints on a free trial basis. License usage toward the trial cap does not produce notifications. The trial period ends when an endpoint license is purchased.

If an endpoint license expires, new endpoints can still be discovered, but they cannot be modeled until a valid license is available.

Endpoints that exceed the total available license capacity will not be included in NQE queries or appear on the Inventory page. Deleting or disabling an endpoint frees up its license count 7 days after its last snapshot.

Navigating the Endpoint Licensing page

To access the Endpoint Licensing page, navigate to: Settings > System > License > Endpoints.

1. Licensed Endpoint Overview: Displays the total licensed endpoint capacity, highlighting the number of licenced endpoints in use and still available.
2. Manage Endpoint Licenses: Opens the Endpoint License Management panel for viewing and managing endpoint licenses.
3. Licensed Endpoints: The Licensed Endpoints section lists all licensed endpoints. The table includes the following details:
   • Endpoint Names: The name(s) assigned to the endpoint.
   • Profile: The associated profile name.
   • Profile Type: The protocol used (e.g., CLI, SNMP, HTTP).
   • Collection IP: The IP address used for collection.
   • Collection Port: The port used for data collection.
   • Networks: The network(s) the endpoint belongs to.
   • Last Snapshot At: The timestamp of the last successful snapshot collection.

Peripheral Device Licensing Overview

Peripheral devices extend on-premises infrastructure and are licensed as part of the On-Prem Device License. Examples of peripheral devices include:

• WiFi Access Points
• Smart NICs (e.g., Pensando) Peripheral Device License Properties:

• License Scope: Peripheral devices cannot be licensed separately.
• Allocation: They consume capacity from the On-Prem Device License and are tracked as a distinct line item.
• License Term: Peripheral device licenses always start and expire on the same dates as the On-Prem Device License.
• Grace Period: A 7-day grace period applies when devices are removed or replaced.
• Management: Org Admins define allocations for both main and peripheral devices within a single license, keeping licensing and compliance aligned.

License Installation

This section outlines the steps for installing licenses specifically for on-prem deployments. SaaS customers can skip these steps as Forward Networks manages the license management for these types of deployments. SaaS customers can still follow these instructions to view their current and past licenses but cannot take actions like adding new licenses.

To install a license, please proceed with the following steps:

Network Device Licensing

Navigate to Settings > System > License > Network devices > Manage device licenses and select Add new license.

Cloud Licensing

Navigate to Settings > System > License > Cloud credit hours > Manage cloud licenses and select Add new license.

Endpoint Licensing

Navigate to Settings > System > License > Endpoints > Manage endpoint licenses and select Add new license.

Adding a new license

1. From the Add new license panel, copy the Instance ID displayed. This is a unique hash representing your Forward instance.

2. Click the link to open Forward Software Central and log in to the Software Central Licenses page.

   Identify the license you want to activate and click on Activate, paste the instance ID, and click Activate.

   Forward verifies the license and if everything is ok, activates the license. Now, copy the License Key.

3. Go back to the license page of your instance and paste the license key into the License key field.

4. Verify the license info and click Activate to finalize the activation process.

Once the license is installed, it will be displayed in the manage licenses drawer with additional license details.