NGX R65 Release Notes - Check Point

More documents

Recommendations

Info

Information About This Document This document contains known limitations from versions prior to NGX R65 that are relevant for this release. Before setting up NGX R65, review this information in conjunction with the latest NGX R65 Release Notes, available at http://www.checkpoint.com/support/technical/documents/index.html. Previously Published Clarifications and Limitations In This Section ClusterXL page 3 Endpoint Security page 11 Eventia Suite page 14 Firewall page 16 Provider-1/SiteManager-1 page 22 SecureXL page 29 SmartCenter Server page 31 SmartPortal page 35 SmartUpdate page 36 UTM-1 Edge page 38 VPN page 39 VPN-1 Power VSX page 39 VPN-1/FireWall-1 NGX R65 Known Limitations Supplement. Last Update — February 4, 2008 5:37 pm 2
ClusterXL ClusterXL In This Section Authentication page 3 Configuration page 3 ConnectControl page 4 General page 4 High Availability page 5 ISP Redundancy page 5 Load Sharing page 5 Platform Specific — Nokia page 6 Platform Specific — Solaris page 7 Platform Specific — Windows page 7 Policy Installation page 7 Security Servers page 7 Services page 7 SmartConsole page 8 State Synchronization page 8 Unsupported Features page 8 VPN-1 Clusters page 9 Authentication 1. When performing manual client authentication (using port 900) to a cluster where the IP addresses of the members are not routable, the URLs returned in the HTML from the replying cluster member contain the non-routable IP address of the member instead of the cluster IP address. This fails subsequent operations. The workaround is to configure the cluster to use a domain name instead of an IP address in the client authentication HTML pages, using the ahttpclientd_redirected_url global property. Make sure that your DNS servers resolve this domain name to the IP address of the cluster. 2. Issues may arise when using automatic or partially automatic client authentication for HTTP on Load Sharing clusters (both ClusterXL and OPSEC clusters). A workaround is to define a decision function based only on IP addresses in order for connections to open. For ClusterXL, go to the ClusterXL tab > Load Sharing > Advanced, and select IPs only. For OPSEC clusters, refer to the product documentation for more information. Configuration 3. In the Rule Base, when adding a cluster object to the source or destination column in a rule, this rule will only apply to the cluster addresses. If the rule needs to be applied to the cluster member addresses, add their objects to the rule as well. 4. To use manual client authentication through HTTP in a cluster environment, set the database property hclient_enable_new_interface to true. This forces the HTTP client authentication daemon to ask for both the user name and password in the same HTML page. When the IP addresses of the cluster members are not routable, the URLs returned in the HTML from the replying cluster member contain the non-routable IP address of the member instead of the IP address of the cluster. This would fail subsequent operations. The workaround in this case is to configure the cluster to use a domain name, using theahttpclientd_redirected_url global property. Make sure that your DNS servers resolve this domain name to the cluster's IP address. 5. Use the commands cpstop and cpstart instead of cprestart on cluster configurations. The command cprestart is not supported on cluster members. VPN-1/FireWall-1 NGX R65 Known Limitations Supplement. Last Update — February 4, 2008 5:37 pm 3
Page 1: Check Point NGX R65 Known Limitatio
Page 5 and 6: ClusterXL 2. Performing an SNMP que
Page 7 and 8: ClusterXL Platform Specific — Sol
Page 9 and 10: ClusterXL 39. The following Web Int
Page 11 and 12: Endpoint Security Endpoint Security
Page 13 and 14: Endpoint Security 18. Endpoint Secu
Page 15 and 16: Eventia Suite 15. To upgrade a dist
Page 17 and 18: Firewall 5. The name of the install
Page 19 and 20: Firewall 31. In a cluster environme
Page 21 and 22: Firewall SecureClient 56. Policy in
Page 23 and 24: Provider-1/SiteManager-1 3. After u
Page 25 and 26: Provider-1/SiteManager-1 In additio
Page 27 and 28: Provider-1/SiteManager-1 SmartUpdat
Page 29 and 30: SecureXL SecureXL In This Section G
Page 31 and 32: SmartCenter Server SmartCenter Serv
Page 33 and 34: SmartCenter Server Policy Installat
Page 35 and 36: SmartPortal Platform Specific - Nok
Page 37 and 38: SmartUpdate Miscellaneous 11. When
Page 39 and 40: VPN VPN VPN Communities 1. When man
Page 41 and 42: VPN-1 Power VSX 27. When connecting

NGX R65 Release Notes - Check Point

Create successful ePaper yourself

Delete template?

Save as template?