topic Re: This package is not supported by current Deployment Agent build in Firewall and Security Management

This package is not supported by current Deployment Agent build

cosmos — Tue, 21 Mar 2023 00:45:57 GMT

The only time I _ever_ need to update CPUSE / CPDA is to install hotfixes.

Is there any reason the agent is not included and installed as part of the hotfix, to mitigate the dependency?

Re: This package is not supported by current Deployment Agent build

Chris_Atkinson — Tue, 21 Mar 2023 01:13:55 GMT

It should routinely self-update avoiding the dependency.

Is this on a machine that has internet access and a valid license or is isolated?

Re: This package is not supported by current Deployment Agent build

the_rock — Tue, 21 Mar 2023 01:27:08 GMT

I agree with Chris, I never have to do this manually, its always auto-updated. I mean, periodically (maybe once a month, if that), I click on "check for update" in web UI, but usually does not return any new versions of CPUSE agent.

Re: This package is not supported by current Deployment Agent build

cosmos — Tue, 21 Mar 2023 01:36:31 GMT

Isolated. Practically all the environments I touch are. Except for maybe management IPS updates via proxy...

Re: This package is not supported by current Deployment Agent build

PhoneBoy — Tue, 21 Mar 2023 02:56:33 GMT

That's not exactly foolproof as you sometimes need the latest deployment agent to install the latest JHF, one not made available in a previous JHF.
In any case, you can always download the Deployment Agent and install it offline here: https://support.checkpoint.com/results/sk/sk92449

I believe we plan to start adding AutoUpdater content to the JHF for offline gateways.
Don't believe CPUSE is currently part of this.

Re: This package is not supported by current Deployment Agent build

cosmos — Tue, 21 Mar 2023 03:00:49 GMT

Wouldn't it be smarter to include the dependent DA in the JHF itself, and install it as part of the HFA if required?

Re: This package is not supported by current Deployment Agent build

_Val_ — Tue, 21 Mar 2023 13:48:33 GMT

Not really, considering you may need an updated DA to install a hotfix. As mentioned above, it is a separate type of software update.

Re: This package is not supported by current Deployment Agent build

cosmos — Tue, 21 Mar 2023 23:29:05 GMT

Of course, that is how it works today and likely a result of the packaging, process and architecture. And I understand it may not be simple to change the process to include the latest DA at the time the HFA is released to hopefully make the offline installation process a tiny bit simpler. It may not sound like much but anything we can do to reduce the amount of maintenance required adds value.

KISS

Re: This package is not supported by current Deployment Agent build

the_rock — Wed, 22 Mar 2023 00:28:43 GMT

I think last part of you statement, I agree with 100%...anything to make upgrade process easier would help.

Re: This package is not supported by current Deployment Agent build

Boaz_Orshav — Thu, 23 Mar 2023 12:55:46 GMT

Notice that when using central deployment from Smart Console or central deployment tool (CDT) it's enough to have the latest DA on the management machine and it will be pushed automatically to the gateways.

Re: This package is not supported by current Deployment Agent build

Bob_Zimmerman — Thu, 23 Mar 2023 14:34:31 GMT

I found that out in the most annoying way possible when a new CPUSE version was in the "gradual deployment" stage. One of the members of the cluster I was trying to upgrade knew about it, but the other member and the management server did not yet. Not particularly hard to deal with. We just check for a new CPUSE build before using CDT and install it if there is one. It's ultimately just a little snag made more noticeable because of how smooth the process is otherwise.

Agreed that if CDT is usable in the environment, it's a great way to address this problem. My environment has a separate firewall between the management and the firewalls, and we had to allow CPRID through it. Now that we have it working, my team doesn't do any manual jumbo installations on firewalls anymore.

Re: This package is not supported by current Deployment Agent build

cosmos — Tue, 28 Mar 2023 01:06:26 GMT

CDT is great, but often we are building new gateways that are not yet managed.

At the very least, it would be great if a link to the latest DA was provided with the HFA download, and as accessible as the HFA itself (no login is required to download the HFA, yet one is to download the DA?).