topic Re: KEX parameters when upgrading R82 --> R82.10 with Blink in General Topics

KEX parameters when upgrading R82 --> R82.10 with Blink

Alex- — Mon, 31 Aug 2026 09:38:39 GMT

I've upgraded an SMS with Blink to R82.10 from R82 and the sntrup761x25519 KEX method is not available, either in Web UI or CLI, even after reboot.

Another log server was set up from scratch with R82.10 and the option there is present.

Upgraded server:

SERVER> show version all Product version Check Point Gaia R82.10 OS build 467 OS kernel version 5.14.0-427.13.1cpx86_64 OS edition 64-bit SERVER> show ssh server kex supported -------------------------------- supported kex: -------------------------------- curve25519-sha256 curve25519-sha256@libssh.org diffie-hellman-group1-sha1 diffie-hellman-group14-sha1 diffie-hellman-group14-sha256 diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 diffie-hellman-group-exchange-sha1 diffie-hellman-group-exchange-sha256 ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 --------------------------------

New server:

NEWSERVER> show version all Product version Check Point Gaia R82.10 OS build 467 OS kernel version 5.14.0-427.13.1cpx86_64 OS edition 64-bit NEWSERVER> show ssh server kex supported -------------------------------- supported kex: -------------------------------- curve25519-sha256 curve25519-sha256@libssh.org diffie-hellman-group1-sha1 diffie-hellman-group14-sha1 diffie-hellman-group14-sha256 diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 diffie-hellman-group-exchange-sha1 diffie-hellman-group-exchange-sha256 ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 sntrup761x25519-sha512@openssh.com --------------------------------

Re: KEX parameters when upgrading R82 --> R82.10 with Blink

Chris_Atkinson — Mon, 31 Aug 2026 13:02:36 GMT

Sounds familiar / similar to this discussion note the dbset cmds mentioned by @Bob_Zimmerman

https://community.checkpoint.com/t5/AI-Network-Firewall/Identical-R82-10-GWs-with-different-options-for-set-ssh-server/m-p/273384#M104120

Re: KEX parameters when upgrading R82 --> R82.10 with Blink

Alex- — Mon, 31 Aug 2026 16:47:30 GMT

OK.

R82.10 is still rough around the edges. At one point of the CPUSE upgrade of the SMS, I got redirected to the Blink install page, making me wonder if I actually clicked on Clean install instead of Upgrade when I was sure I did so. Then it continued on its own and finished the upgrade.

Anyway, for customers who'll care about sntrup out of the box, I'll go with advanced upgrade.

Re: KEX parameters when upgrading R82 --> R82.10 with Blink

Chris_Atkinson — Tue, 01 Sep 2026 03:46:10 GMT

Have asked internally for further feedback on the KEX side, but if you need an urgent answer please reach out to TAC.