Recent Posts

1. Check Point User Center credentials and Internet access from the SmartConsole machine needed in R77.30 (for manual IPS update). In R80.20 you can specify whether you want to run the manual update from SC-machine, management server or gateway. SmartEvent is highly recommended for IPS reporting and visibility. 2.To minimize impact and false…

1. Download the management Server Migration Tool (R77.x to R80.10) from the below SK: Check Point R80.10  2. Untar the tgz to a temp directory on your management server 3. Go to your temp directory and run: ./migrate export [name_of_the_export] 4. copy the [name_of_the_export].tgz to a newly installed R80.10 SMS (first time wizard must be run)…

Another fun fuct (well, not really funny, as it happened in production already) was that we hit Gateway's SIC certificate is getting revoked every few days . It turned out that we added loop routes only for gateways, not for SMSes. So we have deleted all not needed clusters without any issue, but in fact we faced active - active state of SMS…

When you reboot, does the 700 get a new IP every time? If so this would explain why you see this issue, it takes time for the 5600's to establish a tunnel as it does not know the IP at first, the DAIP gateway reports to the management server what it's new IP is. Also the gateway finds out by the new tunnel being built by the remote site, but it…

Automatic NAT is limited to either Policy Targets or 1 Specifiable Gateway. This is the limit. Indeed Manual does not have this limitation, you can select all the targets you want.   I smell an RFE.

Bob,   You should have built a MDSM in ESX and and SMS next to it, the MDSM to import the |CMA and the Secondary SMS to move the CMA to a SMS. There are a lot of problems, these can happen lets say 2 weeks after running all ok and then all the sudden it breaks. So please do rethink your way forward. Regards, Maarten.

About 2 years ago I was in the works to change the external IP of one of our customers and they had quite some 3rd party VPN's (s2s) with other vendor equipment. To arrange a big bang change when you have 5 or more 3rd parties involved located all over the world, you know this will be impossible to achieve. What we came up with was a 2 month…

A VM lab (one four core VM + clone of our production management) didn't yield any conclusive results. Using iperf to generate traffic, we didn't see any noticeable increase in CPU nor any of the latency in ICMP we were seeing in our production environment after the policy installation.    We are going to be installing the R80.10 hotfix that will…

In case anyone else finds this, this is a known issue at the moment that I'm told stared after JHF 121. TAC says a fix is being worked on. 

Anytime I run the healthcheck scrip on my Primary Smart Center running R80.20 on VMWare Hypervisor, I keep seeing WARNING for Zombie processes -- cpm.sh   +-----------------------+ | Processes | +-----------------------+ 1 zombie processes found. PID COMMAND 17393 [cpm.sh] <defunct>          Thank you folks, -DL

Please provide output of commands cphaprob -a if and cphaprob -l list for both cluster members.  You have a pnote failure in the cluster (probably a network interface mismatch or disconnect of some kind).   -- Second Edition of my "Max Power" Firewall Book Now Available at http://www.maxpowerfirewalls.com

We integrated the MS PAC into ours, which says send all published MS IP space direct and everything else to the proxy.  Good luck!