topic Re: Is It Safe to Change SecureXL on a Cluster? in General Topics

Is It Safe to Change SecureXL on a Cluster?

RemoteUser — Fri, 13 Jun 2025 09:52:12 GMT

Hi everyone,

Is it safe to modify the SecureXL mode on a Check Point clusterfor example, switching from UPPAK to KPPAK or vice versa?

Has anyone here made such changes in a production environment?

Are there any known limitations, side effects, or precautions we should be aware of before proceeding?

Thanks a lot in advance!

Re: Is It Safe to Change SecureXL on a Cluster?

the_rock — Fri, 13 Jun 2025 10:42:37 GMT

I would NOT do that during work hours. I had one customer do it after hours and they did not report any issues. What seems to be the problem?

Andy

Re: Is It Safe to Change SecureXL on a Cluster?

the_rock — Fri, 13 Jun 2025 10:45:36 GMT

Good reference

https://community.checkpoint.com/t5/Security-Gateways/SecureXL-UPPAK-Mode-for-Lab/td-p/210731

Re: Is It Safe to Change SecureXL on a Cluster?

Chris_Atkinson — Fri, 13 Jun 2025 11:09:20 GMT

What is the platform model and expansion cards, version / JHF in question?

Typically in a maintenance window do the standby member failover then do the other member.

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_PerformanceTuning_AdminGuide/Content/Topics-PTG/SecureXL-Configuration.htm?tocpath=SecureXL%7C_____6

Re: Is It Safe to Change SecureXL on a Cluster?

RemoteUser — Fri, 13 Jun 2025 13:40:07 GMT

hi bro

just out of curiosity

Re: Is It Safe to Change SecureXL on a Cluster?

the_rock — Fri, 13 Jun 2025 14:22:23 GMT

Thats okay bud. If there is anything you want me to test in the lab, let me know.

Andy

Re: Is It Safe to Change SecureXL on a Cluster?

the_rock — Fri, 13 Jun 2025 15:11:31 GMT

Hey bud,

I changed the mode in my lab cluster, will monitor and let you know if any issues. I have windows PC machine behind it, its doing ssl inspection as well, so will keep checking that as well.

Andy

Re: Is It Safe to Change SecureXL on a Cluster?

the_rock — Sat, 14 Jun 2025 12:13:02 GMT

@RemoteUser

I noticed by default in my R82 lab, mode was kernel, so changed it yesterday to user, rebooted, have not seen any issues.

Andy