topic Re: Does Multi-Domain Server always need to have higher hotfix version than the Firewall Gateway in in General Topics

Does Multi-Domain Server always need to have higher hotfix version than the Firewall Gateway in it?

MVS_VF — Tue, 02 Jul 2024 13:56:11 GMT

Dear Friends!

Please advise if Check Point Multi-Domain Server always need to have the higher hotfix version than the Firewalls in it ?

Currently my Check Point Multi-Domain Server are R81.20 Jumbo Hotfix Take 41 and so are my firewalls on exactly same version.

I am planning to take 'ONLY' my firewalls to recommended Jumbo Hotfix Accumulator take 65;

1) Can I do it without any hinderance or effect any of the cluster firewalls or MDS?

2) If I ALSO do HF upgrade on Check Point Multi-Domain Server and it will definitely restart, will this effect my firewalls in any way?

Kr,

MVS

Re: Does Multi-Domain Server always need to have higher hotfix version than the Firewall Gateway in

Bob_Zimmerman — Tue, 02 Jul 2024 17:48:07 GMT

Certain firewall versions require the management run a jumbo equal to or higher than a certain version. This mostly affects managing newer minor versions. For example, R81.10 jumbo 82 adds the ability to manage R81.20 firewalls.

Some branded hardware requires a particular jumbo for management to be supported. For example, R81.10 jumbo 141 adds the ability to manage 9000-series branded boxes.

Fixes to some issues may need a certain jumbo to be on the management to affect how policy is built.

Other than those three situations, the management jumbo is mostly independent of the firewall jumbo. That said, updating a management is a lot less risky and a lot lower impact than updating firewalls. Why not do it first?

Re: Does Multi-Domain Server always need to have higher hotfix version than the Firewall Gateway in

Tomer_Noy — Wed, 03 Jul 2024 07:09:38 GMT

This is a useful post from a while back (that is still relevant):
https://community.checkpoint.com/t5/Management/Management-JHF-Did-You-Know/m-p/56880/highlight/true#M9115

Bottom line:

Yes, you can install newer JHF on gateways without installing it on the Management.
If you install an HF on the Management it will indeed restart the server, but short downtime on the Management should not affect gateway traffic.
- There are some specific flows that involve the Management (such as CME autoscale, or updating DataCenter objects) but regular behavior should be unaffected.