NGX R65 Release Notes - Check Point

More documents

Recommendations

Info

Provider-1/SiteManager-1 Backup and Restore 9. A backup file created on a Solaris platform with the mds_backup command cannot be restored on a Linux platform, nor vice-versa. A backup made by mds_backup on Linux can be restored on SecurePlatform and vice-versa. 10. When saving the configuration of an MDS (via the command mds_backup), make sure to also back up the configuration of each of the VSX gateways/clusters that are managed by the MDS. When restoring the configuration of the MDS (via the command mds_restore), make sure to restore the configuration of all VSX gateways/clusters immediately afterwards. Migrate 11. After migrating a SmartCenter server running on a Nokia platform to an NGX R65 CMA, the UTM-1 Edge objects and Profiles creation option from SmartDashboard is not available. See SecureKnowledge SK26484 for more information. 12. Migrating a CMA/SmartCenter database to a Provider-1 CMA disables the CMA's PnP license, if any. 13. Migration of a CMA is not supported when VSX objects exist in the database. 14. After migrating Global Policies and CMAs that contain Global VPN Community, the VPN Communities mode of the Global Policies view in the MDG may not display all gateways participating in the Global VPN Communities. To resolve this issue, after completing the migration of all relevant configuration databases and starting the MDS and the CMA processes, issue the following commands in the root shell on the MDS: 1. mdsenv 2. fwm mds rebuild_global_communities_status all 15. When migrating complex databases, the MDG may timeout with the error message Failed to import Customer Management Add-on, even when the migration process continues and is successful. Therefore, when migrating large databases, it is recommended that you run the migrate operation from the command line. See the cma_migrate command in The Upgrade Guide. 16. The migrate_assist utility reports missing files, depending on FTP server type. If files are missing, copy the relevant files manually. More information regarding the relevant files and the directory structure is available in the “Upgrading Provider-1” chapter of The Upgrade Guide. 17. Before migrating the global database, if there are Global VPN Communities in the source database or in the target database, it is highly recommended that you read the “Gradual Upgrade with Global VPN Considerations” section of The Upgrade Guide. 18. If you delete a CMA that has been migrated from an existing CMA or SmartCenter database, and then want to recreate it, first create a new Customer with a new name. Add a new CMA to the new Customer and import the existing CMA or SmartCenter database into the new CMA. 19. After migrating SmartCenter or CMA databases with SmartLSM data, execute the command LSMenabler on on the CMA. 20. After migrating a SmartCenter database which contains SmartDashboard administrators or administrator group objects, these objects remain in the database but are not displayed in SmartDashboard. As the CMA is managed by Customer Administrators via the MDG and not via SmartDashboard, these objects are irrelevant to the CMA. However, if you need to delete or edit one of these objects, use dbedit or GuiDBedit to do so. 21. When migrating a CMA or SmartCenter High Availability (HA) to a new CMA in a different Provider-1/SiteManager-1 environment, be sure to use the primary database of the CMA or SmartCenter HA for the migrate operation. VPN-1/FireWall-1 NGX R65 Known Limitations Supplement. Last Update — February 4, 2008 5:37 pm 24
Provider-1/SiteManager-1 In addition, if the name used for the new CMA is not the name of the previous primary CMA or SmartCenter HA, the new CMA name may not be similar to a name already used for a network object in the migrated database, including the secondary management object. 22. When migrating a CMA or SmartCenter Backup server with Endpoint Security Server installed, the Endpoint Security Server installation does not migrate. The recommended approach for this configuration is the following: 1. Before migrating, open SmartDashboard to the CMA/SmartCenter server to be migrated. 2. Edit the CMA/SmartCenter server object, and deselect Endpoint Security Server from the list of Check Point Products. 3. Run the migrate operation. 4. Reinstall the Endpoint Security Server on the machine on which the CMA resides. 5. Configure the migrated CMA to use Endpoint Security Server. 23. When migrating SmartCenter or CMA configurations that contain SmartDefense settings and protections that were downloaded via SmartDefense Online Update, the migrate_assist tool does not copy all the necessary files, and the target machine will not contain the full original SmartDefense configuration. To resolve this issue, do one of the following: • Copy the directories manually from the source machine according to the instructions found in the Provider-1 User Guide. • Use migrate_assist, and then do the following operations before importing the configuration: A. On the source machine, go to $FWDIR/conf and copy the content of the subdirectory SMC_Files. B. Place the copied content in the directory /conf on the target machine. C. Delete the following files from the target machine: • SMC_Files/monitor/SmartViewMonitor.tar • SMC_Files/asm/post_install_sd_updates • SMC_Files/asm/post_install_sd.ver Global Policy 24. When deleting a Check Point host object created in Global SmartDashboard that has the same name as one of the MDS/MLM servers, the SIC certificate of the matching MDS/MLM server may be revoked. To avoid this situation, refrain from defining Check Point host objects with names identical to MDS/MLM servers in the system. If the certificate of one of the MDS/MLM servers is revoked, see SecureKnowledge SK24204 to remedy the situation. 25. Avoid circular references in the Global Policy, as this will cause its assignment to fail. 26. To ensure the endpoint security of Global Policies, only Provider-1 Superuser and Customer Superuser administrators are allowed to perform a Database Revision Control operation on a CMA. This is to ensure that a lower level administrator does not change the Global Policy assigned to a Customer. This is not a limitation, but rather an effect of the administrator’s permission hierarchy. 27. Assigning a Global Policy to Customers may be a heavy operation. For this reason, it is recommended that you use MDG: Manage > Provider-1/SiteManager-1 Properties > Global Policies and configure Perform Policy operations on 1 customers at a time. For information about an MDS machine that includes a large amount of CMAs and big databases (global database and local CMAs' databases), refer to Hardware Requirements and Recommendations in the Provider-1/SiteManager-1 User Guide. VPN-1/FireWall-1 NGX R65 Known Limitations Supplement. Last Update — February 4, 2008 5:37 pm 25
Page 1 and 2: Check Point NGX R65 Known Limitatio
Page 3 and 4: ClusterXL ClusterXL In This Section
Page 5 and 6: ClusterXL 2. Performing an SNMP que
Page 7 and 8: ClusterXL Platform Specific — Sol
Page 9 and 10: ClusterXL 39. The following Web Int
Page 11 and 12: Endpoint Security Endpoint Security
Page 13 and 14: Endpoint Security 18. Endpoint Secu
Page 15 and 16: Eventia Suite 15. To upgrade a dist
Page 17 and 18: Firewall 5. The name of the install
Page 19 and 20: Firewall 31. In a cluster environme
Page 21 and 22: Firewall SecureClient 56. Policy in
Page 23: Provider-1/SiteManager-1 3. After u
Page 27 and 28: Provider-1/SiteManager-1 SmartUpdat
Page 29 and 30: SecureXL SecureXL In This Section G
Page 31 and 32: SmartCenter Server SmartCenter Serv
Page 33 and 34: SmartCenter Server Policy Installat
Page 35 and 36: SmartPortal Platform Specific - Nok
Page 37 and 38: SmartUpdate Miscellaneous 11. When
Page 39 and 40: VPN VPN VPN Communities 1. When man
Page 41 and 42: VPN-1 Power VSX 27. When connecting

NGX R65 Release Notes - Check Point

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?