topic Re: 39xx appliances are NOT a replacement for any current 5xxx or 6xxx gateway customer! in Firewall and Security Management

39xx appliances are NOT a replacement for any current 5xxx or 6xxx gateway customer!

DH — Wed, 04 Jun 2025 17:34:55 GMT

Regards sk183199...

As I understand it, this means that the 39xx appliances are currently NOT a replacement for customers who use the MTA or want the option of an LB/Active-Active cluster!

Both of these are features available with current 5xxx/6xxx appliances!!

This means that the up to 2.5x speed per appliance comes at the cost of eliminating the posibilty to scale from HA to LB clusters.

Whether and, if so, when these features will be available is unclear...☹

Re: 39xx appliances are NOT a replacement for any current 5xxx or 6xxx gateway customer!

Bob_Zimmerman — Wed, 04 Jun 2025 18:23:32 GMT

My TAC experience is admittedly out of date, but out of hundreds of clusters I worked on, maybe 5% were any kind of load-sharing (including StoneBeat, Nokia IP Clustering, ClusterXL unicast, and ClusterXL multicast).

I'm honestly not sure how many companies host their own email anymore, but I haven't personally used an on-prem mail server in close to a decade. My company's current mail filtering is all externally hosted and mail traffic doesn't touch my firewalls.

My managements are still R81.20 rather than R82, but that's the only reason I couldn't use the 3900s. If ElasticXL is added, we'd definitely be interested in some for offices.

Re: 39xx appliances are NOT a replacement for any current 5xxx or 6xxx gateway customer!

Lesley — Wed, 04 Jun 2025 19:08:33 GMT

Same here many customers, but never see active/active setup. MTA is also years ago 😉

Re: 39xx appliances are NOT a replacement for any current 5xxx or 6xxx gateway customer!

PhoneBoy — Wed, 04 Jun 2025 21:10:07 GMT

It's worth noting that the 3900 series appliances are ARM-based.
This is also the first time we are supporting maintrain Gaia on ARM.
As such, some features are not yet available.
Given ElasticXL (which is Active/Active clustering) is a major feature of R82, I would expect this will be added in a coming version.
Not so sure about ClusterXL since it's more legacy.

Re: 39xx appliances are NOT a replacement for any current 5xxx or 6xxx gateway customer!

Chris_Atkinson — Wed, 04 Jun 2025 23:43:54 GMT

Whilst there are some performance comparisons we've not published these as the successor models, please refer:

https://www.checkpoint.com/support-services/support-life-cycle-policy/

So subject to proper sizing this may be possible noting the limitations mentioned.

Re: 39xx appliances are NOT a replacement for any current 5xxx or 6xxx gateway customer!

Steffen_Appel — Thu, 05 Jun 2025 05:51:59 GMT

Personally I do not know many larger companies, which do not have email on prem. Active/Active clusters with checkpoint are rare, that's true.

Re: 39xx appliances are NOT a replacement for any current 5xxx or 6xxx gateway customer!

Bob_Zimmerman — Thu, 05 Jun 2025 14:52:34 GMT

I have direct knowledge of several Fortune 500 companies' environments, including one of the top five. None of the ones I personally know host their own email on-prem. One uses Google, several use Microsoft, and one used Fujitsu of all providers last I heard. They have some outgoing mail relays in their datacenters, but zero incoming mail.

Re: 39xx appliances are NOT a replacement for any current 5xxx or 6xxx gateway customer!

Steffen_Appel — Thu, 05 Jun 2025 15:25:58 GMT

Maybe it is different in the US, here in Europe I rarely see major companies without internal MTAs.

Re: 39xx appliances are NOT a replacement for any current 5xxx or 6xxx gateway customer!

Bob_Zimmerman — Thu, 05 Jun 2025 15:32:16 GMT

Quite possible, especially with the recent collapse in trust of US tech companies. I know a bunch of European governments use Microsoft and are now trying to move away.

Re: 39xx appliances are NOT a replacement for any current 5xxx or 6xxx gateway customer!

Alex- — Thu, 05 Jun 2025 15:52:40 GMT

Historically, European companies might be more on the conservative side in their technological structures. Most of our established customers still use cloud services quite sparingly and like to have systems under their control. The move to solutions like O365 is more due to licensing "nudges", because Big Tech like their subscription-based model than real enthusiasm.

That's changing with newer companies and startups or big workloads, and of course, AI.

So yes, we still see a bunch of MTA deployments but I don't know for how long.