NGX R65 Release Notes - Check Point

More documents

Recommendations

Info

Provider-1/SiteManager-1 Provider-1/SiteManager-1 In This Section Installation, Upgrade, and Revert page 22 Configuration page 23 Licensing page 23 Backup and Restore page 24 Migrate page 24 Global Policy page 25 Global VPN page 26 Global SmartDefense page 26 SmartUpdate page 27 SmartPortal page 27 Status Monitoring page 27 Eventia Reporter page 27 Authentication page 28 Miscellaneous page 28 Installation, Upgrade, and Revert 1. Some of the issues reported by the Pre-Upgrade Verifier may require database modifications. To avoid having to repeat these changes, remember to synchronize your mirror MDSs/CMAs and perform the ‘install database to CLM’ processes. It is highly recommended that you read the “Upgrading in Multi MDS environment” section in The Upgrade Guide. 2. After upgrading an MDS or MLM in a multi MDS environment, SmartDashboard displays CMA and CLM objects with the previous version, and the following error message appears when performing the operation Install Database: Install Database on Log Server can only be partially completed. To restore full functionality (full resolving and remote operations), upgrade the Log Server to be the same version as your Management Server. In order to update the CMA/CLM objects to the most recent version, use the following procedure after upgrading all MDS and/or MLM servers: 1. Verify that all active CMAs are up and running with valid licenses, and that none of them currently has a SmartDashboard connected. 2. Run the following commands in a root shell on each MDS/MLM server: A. mdsenv B. $MDSDIR/scripts/mds_fix_cmas_clms_version -c ALL 3. Synchronize all Standby CMAs and SmartCenter Backup servers and install the database on the CLMs. In some cases, the MDG will display CMAs with the version that was used before the upgrade. To resolve this issue, after performing steps 1 - 3, do the following: 1. Make sure that each CMA that displays the wrong version is synchronized with the Customer's other CMAs. 2. Restart the MDS containers hosting the problematic CMAs by executing the following commands in a root shell: A. mdsenv B. mdsstop –m C. mdsstart -m VPN-1/FireWall-1 NGX R65 Known Limitations Supplement. Last Update — February 4, 2008 5:37 pm 22
Provider-1/SiteManager-1 3. After upgrading a pre-NGX SmartCenter to NGX R65, software packages (except for UTM-1 Edge firmware packages) that were displayed in the Package Repository of SmartUpdate do not appear. The packages are in the directory $SUROOT, and can be re-added to the Package Repository using the SmartUpdate command Add From File. 4. Management of FireWall-1 4.1 gateways and VPN-1 Net gateways are not supported in NGX R65. Prior to upgrading configurations that contain such gateways, the gateways need to be upgraded to the supported products/ versions. Since the pre-upgrade verification tools will not allow the upgrade to proceed as long as such gateways exist in the configuration database, the objects either need to be deleted from the source management or updated to represent a supported product/ version. If the objects are updated for the sake of allowing the upgrade to proceed, management of the gateways will not be allowed until the gateway software and license is upgraded as well. Please also note that configurations that contain externally managed FireWall-1 4.1 gateways cannot be upgraded to NGX. To allow the upgrade to proceed, these objects need to be updated to represent a supported version. 5. After upgrading an MDS server that includes an installation of Endpoint Security Server that is associated with one of the CMAs, do the following: with one of the CMAs, do the following: 1. Stop the CMA. 2. Log in again to the root account. 3. Start the CMA. Configuration 6. In the SecurePlatform installation, the default maximum number of file handles is set to 65536. This also applies to standard Linux installations, but the default number may vary. For Provider-1/SiteManager-1 installations with a large number of CMAs, 65536 file handles may be insufficient. Indications that the system may not have enough available file handles can be failure of processes to start, and/or crashes of random processes. • To check if insufficient file handles is indeed the problem, enter the following command from root or expert mode: # cat /proc/sys/fs/file-nr This command prints three numbers to the screen. If the middle number is close to zero, or the left number equals the right-most number, it is required to increase the maximum number of file handles. • To increase the maximum number of file handles, enter the following command from root or expert mode: Licensing # echo 131072 > /proc/sys/fs/file-max The number above is for demonstration purposes; the actual figure should be derived from the amount of memory and the number of CMAs. 7. If you upgrade licenses after upgrading the MDS, the upgraded licenses will not be displayed in the MDG until after restarting the MDS. 8. Under rare circumstances, a CMA license may not appear in the SmartUpdate view of the MDG, and yet appear in SmartUpdate when launched from the CMA. If this happens, do the following: 1. From the command line in the CMA environment, use the cplic command to remove the missing license, and then add it again. 2. In SmartUpdate, right-click the CMA and select Get Licenses. VPN-1/FireWall-1 NGX R65 Known Limitations Supplement. Last Update — February 4, 2008 5:37 pm 23
Page 1 and 2: Check Point NGX R65 Known Limitatio
Page 3 and 4: ClusterXL ClusterXL In This Section
Page 5 and 6: ClusterXL 2. Performing an SNMP que
Page 7 and 8: ClusterXL Platform Specific — Sol
Page 9 and 10: ClusterXL 39. The following Web Int
Page 11 and 12: Endpoint Security Endpoint Security
Page 13 and 14: Endpoint Security 18. Endpoint Secu
Page 15 and 16: Eventia Suite 15. To upgrade a dist
Page 17 and 18: Firewall 5. The name of the install
Page 19 and 20: Firewall 31. In a cluster environme
Page 21: Firewall SecureClient 56. Policy in
Page 25 and 26: Provider-1/SiteManager-1 In additio
Page 27 and 28: Provider-1/SiteManager-1 SmartUpdat
Page 29 and 30: SecureXL SecureXL In This Section G
Page 31 and 32: SmartCenter Server SmartCenter Serv
Page 33 and 34: SmartCenter Server Policy Installat
Page 35 and 36: SmartPortal Platform Specific - Nok
Page 37 and 38: SmartUpdate Miscellaneous 11. When
Page 39 and 40: VPN VPN VPN Communities 1. When man
Page 41 and 42: VPN-1 Power VSX 27. When connecting

NGX R65 Release Notes - Check Point

Create successful ePaper yourself

Delete template?

Save as template?