topic Re: Check Point issues even they can’t resolve! in General Topics

Check Point issues even they can’t resolve!

cmpwat — Wed, 28 Oct 2020 21:40:44 GMT

So, I have been advised by Phoneboy to post my issues here with the hope that someone might be able to provide some help on them so here goes..... oh it’s a long one!

We were forced to upgrade from R77.30 like a lot of people so arranged for a new gateway and management server to be built on new Dell PowerEdge servers (both of which were checked by CheckPoint and confirmed as ok; they were in the compatibility list.)

Both the management server and gateway were built on R80.30 and to begin with, all was fine. However before long we noticed a memory leak in that 32gb of ram was being consumed to the point the gateway was either crashing and rebooted or it required a reboot after 12 hours. It was decided that the issue was my licence hasn’t been cut correctly and was still running an old version so needed to be renewed, which is did, but then the issue with CPUs started.

the gateway was using more CPUs than it was licences for, cue some more investigations and was told that the only way to resolve this was to upgrade to R80.40.

this was planned and carried out and more issues occurred! Our Secureid VPNs no longer worked and the work around from CP didn’t work either. So to stop the whole business from not being able to connect, I rolled back, using the CP method and this failed. We had to reset the database on the gateway and the management server to get the 2 to talk again but in doing so the threat management blade screwed up and the only to resolve is to rebuild the gateway!

CP provided us with a 5900 to use whilst we had out open server rebuilt to R80.40. The applicable is on R80.40 but we cannot use it as the Secureid VPNs still do not work. It’s been looked at a number of times and logs taken and the developers still haven’t got a fix.

So I have:

an open server with a potential memory leak if I use my licence. If I use an eval licence then we have too many CPUs being used. The ‘fix’ for this is to update to R80.40 but this doesn’t work as it’s stops my users connecting to the VPN as the SDCONF.rec file keeps overwriting (yes the SK has been read and doesn’t work).

I have an 5900 that I cannot use as it’s in R80.40 and has the same issues as the open server with the SDCONF.rec file. Not sure about the memory or CPU as it’s not been used in anger!

so I am hoping that R81 will be the saviour to all of this as it’s been over 6 months now and I still do not have a fully working gateway and management server that doesn’t require some sort of babysitting on a weekly, if not daily, basis.

Re: Check Point issues even they can’t resolve!

PhoneBoy — Wed, 28 Oct 2020 23:06:00 GMT

The sdconf.rec-type integration with SecurID has been around for a long time, but I think the current way to integrate is via RADIUS.
Is there some reason you're not using RADIUS?

If you can send me the SRs in a PM/email, we can look into the memory leaks.

Re: Check Point issues even they can’t resolve!

Kaspars_Zibarts — Thu, 29 Oct 2020 06:15:28 GMT

5900 can run R80.30. Have you considered that option? It's a more mature release by far. R80.40 is still pretty "young". I would not entertain idea of R81 for business critical network. Are you running VSX, just curious

Re: Check Point issues even they can’t resolve!

cmpwat — Thu, 29 Oct 2020 08:16:31 GMT

The sdconf method was setup by my predecessor and works in R80.30 with no problems, so on that basis it should work on R80.40! I’m not about to change the way users authenticate in the middle of a pandemic and most are working from home.

with regards to the SRs, I do not have them, as a 3rd party is liaising with Check Point and have the SRs.

Re: Check Point issues even they can’t resolve!

cmpwat — Thu, 29 Oct 2020 08:18:38 GMT

I was told by Check Point to install R80.40 as a fix for the memory leak we are suffering on the open server, so not really had a choice about it.

as for not entertaining R81, I agree but at the moment I do not have a full, working solution on either my open server or the loan 5900

Re: Check Point issues even they can’t resolve!

_Val_ — Thu, 29 Oct 2020 08:59:23 GMT

Would you be so kind to send me your SR numbers in a private message?

Thanks

Val

Re: Check Point issues even they can’t resolve!

_Val_ — Thu, 29 Oct 2020 09:47:58 GMT

Respectfully disagree. R80.40 is the recommended version now, with lots of things that are fixed from R80.30

Re: Check Point issues even they can’t resolve!

_Val_ — Thu, 29 Oct 2020 09:53:06 GMT

Where do you configure sdconf.rec files, management or GW? Phoneboy has a point, the best practice is to configure Radius auth on the management side. If you are doing it on per GW, please look into sk166314.

Re: Check Point issues even they can’t resolve!

Kaspars_Zibarts — Thu, 29 Oct 2020 10:21:32 GMT

@_Val_ yes "recommended" and operational reality does not always go hand in hand 🙂 plus you work for CP hehe. Reality for us was that nearly 100% of my workload a week after R80.40 deployment was spent on fault investigations and debugging. Fairly significant issues for production critical environments. Therefore I would respectfully stay with the comment "R80.30 is more mature than R80.40" 🙂

Lets park it there, it's not the topic of this thread. I respect your opinion! 👍

Re: Check Point issues even they can’t resolve!

_Val_ — Thu, 29 Oct 2020 10:48:38 GMT

I respect your opinion. Just a closing note, a release being pushed from "all" to "recommended" - that is done based on the field statistical data and telemetry. We do not do it lightly.

Re: Check Point issues even they can’t resolve!

_Val_ — Thu, 29 Oct 2020 11:11:00 GMT

@cmpwat another note.

You are claiming, there are serious issues (quoting) "even Check Point can't resolve". To address this claim, we need to review your technical support cases. With all due respect, getting those SR numbers and giving us a fair chance to work them through should not be too complicated.

I have pulled your company data, and I do not see a single open support requests there. Your latest support calls were closed in June 2020. I am also having a hard time finding anything that would be relevant to the issues you mention in this post.

We encourage honest and transparent communication in this community. Your opinion is important, and also we would like to help as much as we can, and in any way we can, to resolve something that needs to be fixed. If required, we are in a position to ask developers and support experts for assistance.

However, the amount of actionable information in this discussion does not allow us to provide you with meaningful answers. Kindly check if you can get more from your support partner.

Thanks for your assistance,
Val

Re: Check Point issues even they can’t resolve!

PhoneBoy — Sun, 01 Nov 2020 05:28:47 GMT

One major difference between R80.30 and R80.40 is the Linux kernel.
I suspect this is having something to do with the sdconf.rec issue you’re having.
Changing to radius should not impact how your users authenticate.

Re: Check Point issues even they can’t resolve!

PhoneBoy — Mon, 02 Nov 2020 05:31:53 GMT

Also the support partner should be able to provide the Check Point SRs in question.

Re: Check Point issues even they can’t resolve!

cmpwat — Mon, 02 Nov 2020 08:17:29 GMT

But the question is why should change to radius, or in another way, why should I be pushed into change my authentication method by Check Point?

My current method worked for a long time on R77.30. It works on R80.30 with no problem. Its now not working on R80.40. Surely Check Point should be looking to resolve this and not force admins to change methods. Its not a simple change.

Re: Check Point issues even they can’t resolve!

_Val_ — Mon, 02 Nov 2020 08:59:18 GMT

One again, I urge you to provide relevant SRs so we could look into this.

Thanks

Val

Re: Check Point issues even they can’t resolve!

_Val_ — Mon, 02 Nov 2020 11:51:01 GMT

When looking in the SR, I can see that your support specialist has provided you the fix the last week. I am looking forward to hearing about the results. Please do inform the community about the outcome.

Re: Check Point issues even they can’t resolve!

cmpwat — Tue, 03 Nov 2020 05:47:32 GMT

Just to keep everyone happy and up to date, Check Point provided a custom patch for my R80.40 appliance which, surprise surprise, didn't work.

I installed it this morning and tested the Endpoint Security client and it would still would not connect, so we are back to square one using an Open Server, running R80.30 with a knackered Threat Prevention blade caused by the Check Point recovery process and the only way to fix is rebuild, which I cannot do as this is the live firewall so would need something in its place, which is where the 5900 comes in, which is running R80.40 but doesn't allow my users to connect in remotely...... I'm getting dizzy going round and round in circles.

Re: Check Point issues even they can’t resolve!

HristoGrigorov — Tue, 03 Nov 2020 06:47:07 GMT

Man, I understand your frustration but throwing stones at CheckPoint without considering their advices is not going to solve your problem at the end of the day. Why don't you just make a conference call with your support partner and TAC and you do not come up with a plan that works best for you with zero downtime. Sorry but I do not really see how can the community here help you in this case.

Re: Check Point issues even they can’t resolve!

_Val_ — Tue, 03 Nov 2020 07:34:21 GMT

@cmpwat Wayne, R&D is trying to get in touch with you. Could you please answer Ilya's email from Sunday?

Thanks you
Val

Re: Check Point issues even they can’t resolve!

cmpwat — Tue, 03 Nov 2020 12:00:22 GMT

I think after 6 months of issues, downtime, "fixes", support calls, conference calls, dead ends and out of hours debugging I am entitled to "throw stones" as you put it!

This is not about having a go at Check Point, more its asking the community if they have seen similar issues and if so who did they fix it; its about trying to utilize the collective knowledge of the Check Point community that think of something to try that hasn't been thought of already.

ADMIN NOTE: this comment is edited to comply with the community guidance. For any further clarification, reach out ot @_Val_
We urge all community members to maintain professional integrity, to be friendly and courteous.