topic Re: R82 feedback in Firewall and Security Management

R82 feedback

the_rock — Wed, 19 Jun 2024 15:18:14 GMT

Hey boys and girls,

Wanted to quickly share about R82 EA, as I ended up upgrading my R81.20 standalone lab to see what the process looked like. So far, not too bad, it took bit of time, as its standalone, so had to re-import the mgmt database.

I would say, make sure you have enough space in root dir, and also, something to keep in mind below.

Smart console looks literally the same, but I see there are way more options in legacy dashboard for mobile access blade.

Https inspection policy also looks more robust than before, so thats fantastic.

This is what came up after the upgrade, not sure if its expected. I will keep adding more things as I discover them.

[Expert@CP-STANDALONE:0]# cpinfo -y fw1
cp_get_kernel_version: ERROR: kernel version 4.18.0-372.9.1cpx86_64 is unknown. Perhaps 4.18.0-372.9.1cpx86_64 needs to be added as a version to cp_get_kernel_version and CpOsKernelVersion?

This is Check Point CPinfo Build 914000248 for GAIA
[FW1]
HOTFIX_WEBCONSOLE_AUTOUPDATE
HOTFIX_GOT_MGMT_AUTOUPDATE
HOTFIX_NGM_DOCTOR_AUTOUPDATE
HOTFIX_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE
HOTFIX_VCE_R81_20_AUTOUPDATE
HOTFIX_GOT_TPCONF_MGMT_AUTOUPDATE
HOTFIX_GOT_TPCONF_AUTOUPDATE

FW1 build number:
This is Check Point Security Management Server R82 - Build 690
This is Check Point's software version R82 - Build 760
kernel: R82 - Build 735

Best,

Andy

Re: R82 feedback

the_rock — Wed, 19 Jun 2024 16:10:52 GMT

I really like below changes in dashboard...subtle, but nice 🙂

Andy

Re: R82 feedback

the_rock — Wed, 19 Jun 2024 16:33:28 GMT

Here is something I find a bit ironic...shows its vulnerable to latest vpn CVE, but I suppose it might be as its not official release yet? Maybe someone from CP can comment and no, its NOT available to install.

Andy

Re: R82 feedback

Timothy_Hall — Wed, 03 Jul 2024 15:17:18 GMT

Yep I noted the deprecation of the e1000 driver in my Gateway Performance Optimization Course on the page shown below. There will also be a major jump in all NIC driver versions due to the new 4.10.0-372.9 kernel that may cause behavioral changes at the network level.

Also a new R82 tool called connview that allows the easy viewing of connection attributes such as what processing path they are in, why they are slowpath, etc. This replaces the jumble of different commands used to determine this information in R81.20 and earlier such as fw ctl multik gconn, fwaccel conns, fw tab -t connections -z, fw_mux, fw_streaming, etc. I attached the relevant page for that too. A few other tidbits I'm excited about in R82:

1) The much more efficient Galois Counter Mode (GCM) AES algorithms are now available for IKE Phase 1, not just Phase 2/IPSec. Also a new enhanced VPN Monitoring Tool to replace the SmartView Monitor status screens.

2) Hyperflow/pipelining can boost CIFS/SMB connections

3) A new implementation of the gateway logging mechanism that is multi-threaded (no more legacy fwd log bottlenecks).

~~4) R77.30 is no longer supported for backward management compatibility with gateways!~~

Re: R82 feedback

the_rock — Wed, 19 Jun 2024 16:42:18 GMT

Thanks Tim. I cant speak for compatibility, as I was unable to find reference to that fact, but, if you try create new fw, it lets you choose all the way back to R70. One cool thing is that when you do create new fw object, it enabled those 2 TP blades automatically, so if you dont need them, you can turn it off.

Andy

Re: R82 feedback

Timothy_Hall — Wed, 19 Jun 2024 17:11:02 GMT

You are right, I was looking at the wrong table in the release notes. Backward compatibility does work back to R77.30 but apparently no earlier than that.

Re: R82 feedback

the_rock — Wed, 19 Jun 2024 17:30:36 GMT

Of course Im right man, Im ALWAYS right 😉

Just kidding, Im usually way more wrong than right 🤣🤣🤣

Anyway, its just odd that when you try create fw object, it lets you go all the way back to R70...

Andy

Re: R82 feedback

the_rock — Wed, 19 Jun 2024 17:41:00 GMT

Btw, where did you get release notes from? I looked on support site, also all the docs from other community link when you register for EA program and dont see release notes anywhere.

Andy

Re: R82 feedback

the_rock — Wed, 19 Jun 2024 19:35:12 GMT

Not sure if this could be just space issue in my lab, but ever since I upgraded, cant open log tab at all to get any data. I replaced httpd2-smartview.conf file from working environment (though R81.20), shut down, rebooted many times, cpstop; cpstart, installed policy, database, nothing.

Anyway, for now, Im just using old school tracker to check logs when needed.

Not a big deal, since its just a lab, but too coincidental it would happen right after upgrade to R82...before that, all worked fine.

Andy

Re: R82 feedback

Timothy_Hall — Wed, 19 Jun 2024 23:51:18 GMT

It's just one of the download links, here is how you get there:

Re: R82 feedback

the_rock — Thu, 20 Jun 2024 00:48:34 GMT

K, got it, sorry, I downloaded documentation package today, totally missed that 3rd link. Anyway, dont really see any backwards compatibility list, so its possible not finalized yet?

Andy

Re: R82 feedback

the_rock — Thu, 20 Jun 2024 00:50:17 GMT

Never mind, been long day today, I think this is it...

Andy

Management Server and Security Gateway
Versions
Note - For more information about Security Management Servers and supported
managed Security Gateways see sk113113.
R82 Management Servers can manage Security Gateways that run these versions:
Gateway Type Release Version
Security Gateway and VSX R82, R81.20, R81.10, R81,
R80.40, R80.30, R80.20, R80.10
Security Groups on Maestro R82, R81.20, R81.10, R81,
R80.30SP, R80.20SP
Security Groups on Scalable Chassis R82, R81.20, R81.10, R81,
R80.20SP
Quantum Spark, Quantum Rugged,
and SMB Appliances
R81.10.X,
R80.20.X,
R77.20.8X

Re: R82 feedback

the_rock — Thu, 20 Jun 2024 00:53:11 GMT

Update on this...so I installed R82 console on different windows vm, logged in and when its brand new smart console install, logs tab shows by default fw logs, but if you hit plus sign to open new tab, its exact same issue.

I can only assume this is a bug, as smartview service is totally fine on my machine when I run cpwd_admin list.

Maybe someone from Check Point can confirm?

Best,

Andy

Re: R82 feedback

Ido_Shoshana — Thu, 20 Jun 2024 08:07:24 GMT

Hi,

we are not familiar with such an issue.

can you say which build/take of smartconsole you are using?

Re: R82 feedback

the_rock — Thu, 20 Jun 2024 10:52:56 GMT

Yes, will check later...just having some licensing issues with the lab, so once thats resolved, will try again and see. In the meantime, will open demo smart console and send the version.

Andy

Re: R82 feedback

the_rock — Thu, 20 Jun 2024 11:28:05 GMT

Hey @Ido_Shoshana

This is the one I downloaded...I assume thats probably the only version available.

Andy

Re: R82 feedback

Ido_Shoshana — Thu, 20 Jun 2024 14:47:40 GMT

Thanks Andy

Hi, we need to ask the smartconsole.log after turning on debug level.

run SCConfigManager as admin. type: 1 → Debug → 2 → Full → 7
Clear all log files (in /output folder)
Go to SC and try again
send us the logs
change again the debug level

Can we have it? 🙂

Re: R82 feedback

the_rock — Thu, 20 Jun 2024 15:01:36 GMT

We need to apply new license to our eve-ng lab, so once done, I can access the server again 🙂

Andy

Re: R82 feedback

Ido_Shoshana — Thu, 20 Jun 2024 15:09:50 GMT

Great, much appreciated

Re: R82 feedback

the_rock — Thu, 20 Jun 2024 16:42:33 GMT

On another note, any idea how to fix this?

I followed uninstall command from sk, but same issue : - (

Andy