NGX R65 Release Notes - Check Point

VPN-1 Power VSX
SmartCenter
7. To establish trust with newly created Virtual Devices, the IP address of the management server
must be routable from the VSX gateway. When a management server has more then one
interface, make sure to select the IP address of the proper interface to serve as the
management server's IP address.
8. The Install Database operation is not supported on Virtual Devices.
9. The Policy Uninstall operation is not supported on VSX clusters.
SmartDashboard
10. After creating a VSX gateway or cluster, its IP address cannot be changed.
11. The name of a Virtual Device should not exceed 64 characters. In cluster scenarios, the
Member Virtual Device name is a composite of the Member name and the Cluster Virtual
Device name. This could result in a Virtual Device name which contains more than 64
characters.
12. After resetting the SIC for a VSX gateway or cluster member, reinstall policy.
13. When adding NATed addresses to the topology of a Virtual System, only address ranges are
supported. To add a single IP address or an IP subnet, define it as an address range.
14. Editing the name of the VSX management interface is not supported.
15. When editing a VSX gateway or cluster object using the Creation Templates tab, you can only
switch to a Customized Virtual System. Please note that this act is irreversible.
16. Propagating routes from Virtual Routers to Virtual Systems is not supported.
17. When using the vsx_util reconfigure command line utility to reconfigure a VSX gateway, the SIC
status of the network object does not change to Communicating. While this will result in
warnings regarding trust establishment on VS/VR for this specific object, the messages can be
safely ignored.
18. When configuring a host object as a Web Server in a deployment that contains configured
Virtual Systems, on the Web Server tab, set the Protected by field to contain targets that do not
include Virtual Systems.
19. When defining NAT routes on the Topology tab of the Virtual System, insert two IP addresses,
the first and last address of the IP range used for NATing. Note that large ranges can result in
a slow response from the SmartCenter server.
20. When activating the "General HTTP Worm Catcher" SmartDefense protection on a VSX gateway,
all HTTP traffic is scanned for worms, regardless of the scope.
Policy Installation
21. Policy cannot be installed on more then 10 Virtual Systems simultaneously.
22. VSX does not support the SmartDefense Profiles feature.
23. Virtual Systems cannot be managed from a Secondary management server.
VSX NG AI Management Issues
24. When creating a NG AI Virtual Device, the main IP address of the Virtual Device should be
routable from the SmartCenter server.
25. When two Virtual Systems with internal IP addresses that originate from identical subnets (that
is, overlapping subnets) are connected through a Virtual Switch, the internal interface of one of
the Virtual Systems cannot be propagated.
26. To enable the synchronization of routing information between cluster members, the policy on
the VSX cluster must allow communication between cluster members on TCP port 2010.
VPN-1/FireWall-1 NGX R65 Known Limitations Supplement. Last Update — February 4, 2008 5:37 pm 40