topic Re: Updatable SmartConsole Early Availability in Firewall and Security Management

Updatable SmartConsole Early Availability

Dima_M — Mon, 22 Feb 2021 06:37:52 GMT

Hi all,

We’re excited to announce an Updatable SmartConsole Early Availability for CheckMates members. We encourage you to give it a try and eager to get your feedbacks (you can reply to the post or send me an email), your opinion is very valuable for us!

Notes:

Current version is based on Check Point R81 General Availability release, please note that current build number doesn’t isn’t real, but once Updatable SmartConsole will be released, it will reflect an actual build number.
Installation requires administrator permissions. Update requires admin permissions only if the installation location requires it (e.g. C:\Program Files (x86) requires admin permissions, %LocalAppData% does not), Background updates without requiring administrator permission will be introduced soon.
Currently the update process does not delete previous versions. This feature will be added soon as well.

Instructions:

Download and Install the latest SmartConsole from sk170116
When an update is available, a few minutes after SmartConsole is opened, the following message will appear (If SmartConsole was launched from the installation wizard, this message is skipped).

Clicking “Install Now” will be followed after a about a minute by Windows’ message to approve administrator’s permissions for the update process (we are working on a solution to reduce that delay).
When the update finishes, another popup will appear:

This will restart SmartConsole into the newly installed version.
Uninstalling SmartConsole from the Add/Remove Programs dialog will remove all versions of SmartConsole R81.

Looking forward for your feedback!

All the credit goes to: @Omer_Ran @Raz_Shlomo @Neta_Sadeh @Alon_Alapi

(Edited by PhoneBoy on 21 Feb 2021)

Re: Updatable SmartConsole Early Availability

Bob_Zimmerman — Thu, 19 Nov 2020 21:42:56 GMT

Old SmartConsole let you launch other applications and would pass your credentials to the new application so you wouldn't have to log in again. Does this do something similar, or do you need to log in to the new version once it launches?

Either way, this is pretty great! Updating SmartConsole has long been a headache in my organization (VDIs which revert to the base image seemingly at random).

Re: Updatable SmartConsole Early Availability

Jerry — Thu, 19 Nov 2020 23:14:21 GMT

unable to download ... I wish I could beta-test that product tonite ... 😞

Re: Updatable SmartConsole Early Availability

Tomer_Noy — Thu, 19 Nov 2020 23:19:28 GMT

Looks like there's a problem with the link.

Easiest way to get it is to open the following in WinSCP:
sftp://q2lOnd:Q8iLiSOw@sftp.checkpoint.com/outgoing/

In that folder, you'll find the installer file: SmartConsole_995000008_1.exe

@Dima_M - Please check the link and fix it if needed.

Re: Updatable SmartConsole Early Availability

Jerry — Thu, 19 Nov 2020 23:20:58 GMT

yup, I've figured it out already and SFTP download completed now 🙂 just broken link but if you take it down and sftp manually indeed in a folder U'll find mentioned file.

installing 🙂

Re: Updatable SmartConsole Early Availability

Dima_M — Fri, 20 Nov 2020 04:21:31 GMT

Link is working now.

Re: Updatable SmartConsole Early Availability

Scott_Paisley — Mon, 23 Nov 2020 16:15:11 GMT

Will it ever be 64 bit?

Re: Updatable SmartConsole Early Availability

HristoGrigorov — Mon, 23 Nov 2020 17:06:35 GMT

For what benefit ? I don't see any practical advantages to have it 64 bit.

Re: Updatable SmartConsole Early Availability

Jerry — Mon, 23 Nov 2020 17:48:59 GMT

completely agree, what's the point of having SC with 64bit? what's the benefit though? any elaboration on that Scott?

ever since SC is 32bit nobody ever complained about it's "compile or build" just because it isn't 64bit so that is really interesting.

would be also great of anyone of you folks (cp-epmployees) have a say here about all this?

Re: Updatable SmartConsole Early Availability

Scott_Paisley — Mon, 23 Nov 2020 19:39:11 GMT

All of the boxes I run it on are 64bit, and this is about the only 32bit app left. It may not be a problem, although when it hangs it leaves a lot of garbage behind. I was just asking.

Re: Updatable SmartConsole Early Availability

Bob_Zimmerman — Mon, 23 Nov 2020 19:55:06 GMT

WoW64 has a performance hit for all syscalls and many API calls. Basically, you have Win32 thunks which translate the calls as needed, then forward them to the real Win64 calls. When using Win64 directly, there's no need to call to the thunks at all, you just make the Win64 calls yourself. This is only something like a quarter of a percent on calls which dip into kernelspace (because the userspace to kernelspace transition is extremely expensive), but higher on purely userspace calls.

Separately, Microsoft also supports Windows on aarch64 and there is a set of translation layers to allow it to run ia32 Win32 software and amd64 Win64 software. Running ia32 Win32 software on aarch64 has more significant performance hits than running amd64 Win64 software on aarch64.

The performance impact is small, but it is there. SmartConsole performance isn't critical to the use of the product, but it's definitely nice to have faster client-side software. Saves time, saves energy, and so on.

Re: Updatable SmartConsole Early Availability

Jerry — Tue, 24 Nov 2020 08:23:23 GMT

hi all

little thing to add if you don't mind

I've used this EA SC for few days now and I'm happy to share my impressions with you all should anyone care and willing to fix/improve/debug:

1. I've had no single chance to "verify policy" on my standalone R81 with success, all the time I run Verify Policy I receive error as following:

2. I've started to have much much often following errors when connecting from none "Mgmt" interface (still permitted and always used with no issues) - please don't ask me CCSA questions how I'm connecting to the FWA alright? This error is completely isolated issue and not related to rights, acl's, host-access, gui permit etc.!):

Summary: anyone who want's to take a look and work on that I'm 24/7 avail. for you chaps 🙂

Jerry

Re: Updatable SmartConsole Early Availability

Raz_Shlomo — Tue, 24 Nov 2020 08:44:29 GMT

Hi Jerry,

I would like to have some log files in order to check it.

All SmartConsole*.log files located in your 'app data' -> Check Point/SmartConsole/R81
cpm*.elg from your management server. Located under $MDS_FWDIR/log
install*.elg

Can you send them to me please?

Also, please share date and time with the errors

Thanks,

Raz

Re: Updatable SmartConsole Early Availability

Jerry — Tue, 24 Nov 2020 08:49:02 GMT

hi Raz

I'll be happy to do that for you. Just bear with me and send me an email if you can with sftp access so I can share those files with you. I don't think they're tiny enough to be shared via email or message on that platform, aren't they? Let me check.

Jerry

Re: Updatable SmartConsole Early Availability

Jerry — Tue, 24 Nov 2020 09:03:13 GMT

found something in SC logs on SC computer:

[12] [24 Nov 2020 09:01:21,059] (ERROR) CP.Infrastructure.DLE.MgmtServerExceptionsHandler - Management server error
System.ServiceModel.Security.SecurityNegotiationException: Could not establish secure channel for SSL/TLS with authority 'cp:19009'. ---> System.Net.WebException: The request was aborted: Could not create SSL/TLS secure channel.
at System.Net.HttpWebRequest.GetResponse()
at System.ServiceModel.Channels.HttpChannelFactory`1.HttpRequestChannel.HttpChannelRequest.WaitForReply(TimeSpan timeout)
--- End of inner exception stack trace ---

*** interesting, seems like network issue rather than console am I right assuming it is the case Raz?

Re: Updatable SmartConsole Early Availability

Jerry — Tue, 24 Nov 2020 09:23:54 GMT

@Raz_Shlomo I think that thanks for your logs enquiry I've managed to find the root causes - my portal pki cert expired this very August, now I've replaced this with current cert and pushed policy. Let's see if that was the cause. Will keep you posted here 🙂 Cheers!

Re: Updatable SmartConsole Early Availability

Raz_Shlomo — Tue, 24 Nov 2020 09:48:19 GMT

@Jerry , sounds correct. Let me know if it was fixed.

Regarding the verification, can you share cpm*.elg and install*.elg from $MDS_FWDIR/log? send them to me privately.

Please mention the time you tried to do the verification.

Raz

Re: Updatable SmartConsole Early Availability

Jerry — Tue, 24 Nov 2020 10:22:20 GMT

Alright. Got Verification failing. Time stamp is 10:20 UK Time. File is stripped from that time frame and flies to you via PM shortly.

Re: Updatable SmartConsole Early Availability

Jerry — Wed, 25 Nov 2020 08:53:00 GMT

another I supposed "bug" from recent R81 SC. all hitcounts hover bubble's on the lefthand side looks as following:

what you say guys? hope it helps to narrow some creepy little things along the way.

ps. should you need to see it live or get some files from my lab do let me know 🙂

Cheers

Re: Updatable SmartConsole Early Availability

Tomer_Noy — Wed, 25 Nov 2020 11:57:21 GMT

Hi @Jerry ,

This post should be focused on the new updatable capability of SmartConsole. We'd be glad to hear about your experience with the updatability (was it simple, fast, did it work well?), or with issues that are specific to this package and do not happen with the regular GA SmartConsole.

If you have other feedback on the R81 release itself, whether SmartConsole bugs or other, it would be better to discuss them by a private message or another thread that would be dedicated to that.

Thanks,
Tomer