topic Re: R77.30 Take 286: New Jumbo Hotfix GA Release in General Topics

R77.30 Take 286: New Jumbo Hotfix GA Release

PhoneBoy — Mon, 25 Sep 2017 15:32:10 GMT

A new General Availability Jumbo Hotfix Accumulator take for R77.30 (take_286) is available.

It includes important stability and Security software updates:

Support for TLS 1.2 - sk107166.
support for Smart-1 405 and 410 appliances - sk117578.
Support for Online Certificate Status Protocol (OCSP).
Improved MTA.
Support for Capsule Workspace App Wrapping - sk111558.
Support for Mobile Access Reverse Proxy -sk110348.

Take_286 is the latest General Availability release that can be directly downloaded from Check Point Cloud using CPUSE and from sk106162

Take	Date	CPUSE Identifier	CPUSE offline package
Take_286	13 Sep 2017	Check_Point_R77_30_JUMBO_HF_1_Bundle_T286_FULL.tgz	(TGZ)

Note: Effective Sep 25th 2017, the General Availability Take_286 is available for CPUSE online installation in Gaia Portal and Gaia Clish (it replaces Take_216).

Notes:

For Threat Emulation customers that do not allow automatic updates from the cloud, and following the integration of TLS1.2 support,

it is important to update the Threat Emulation Engine according to the next SK: sk92509 - Offline updates for Threat Emulation images and engine.

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

Danny — Mon, 25 Sep 2017 17:10:34 GMT

When I installed this Take_286 last Thursday, my SmartCenter CA broke. Neither sk33224 nor sk101833 solved the issue. So I reverted back to the previous Take_226 which solved it but broke my Gaia WebUI that worked previously.

I opened a Service Request last Friday and I'm still waiting for a Remote Session. Support wanted cpinfo -z -o cpinfo.gz, cpinfo -y all, migrate export and screen shot of the issue that I had already attached and then delayed this ever since. Hopefully they'll do a remote session tomorrow to look into it.

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

Gaurav_Pandya — Mon, 25 Sep 2017 17:35:05 GMT

Hi,

We have applied Take_282 to one of our customer, based on inputs from TAC last week. It seems to be very stable.

No issue till now.

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

KennyManrique — Tue, 26 Sep 2017 15:25:14 GMT

Hello Danny,

I had the same problem installing the first take with TLS 1.2 Support (HFA 266).

After a rollback to my original HFA 225, and verify the symptoms of sk115732 and sk91380, none of them applied for me.

I did some research and to solve first I had to verify the parameter name was SSLMutex on file "/web/templates/httpd-ssl.conf.templ", this because on the new HFA the instruction SSLMutex is replaced by Mutex (this because of apache update):

[Expert@hostname:0]# cat /web/templates/httpd-ssl.conf.templ | grep SSLMutex
SSLMutex file:/usr/local/apache2/logs/ssl_mutex

Then, I tried to start manually the httpd2 process:

[Expert@hostname:0]# /opt/CPshrd-R77/web/Apache/2.2.0/bin/httpd2 -k start -f /web/conf/httpd2.conf -D FOREGROUND

After executing this I got an error of corrupted library (and the path). I replace the library from another gateway with same version and HFA as original (R77.30 HFA 225) and after this the Gaia WebUI was accesible again.

Regards.

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

Danny — Tue, 26 Sep 2017 15:51:28 GMT

Thanks for your response. The Gaia WebUI issue was fixed in JHF Take 286 (see Release Notes). My issue is that it introduced another issue with the SmartCenter CA. I'm still waiting for Check Point R&D to provide a Remote Session in order to fix it.

I also upgraded another Customer to JHF Take 286 today without any issues. Fingers crossed.

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

KennyManrique — Tue, 26 Sep 2017 15:59:15 GMT

Great to hear that! Please let us know the news about your CA issues. Also had customers with old GA HFA because of this.

Regards.

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

Hugo_vd_Kooij — Wed, 27 Sep 2017 12:31:30 GMT

I missed the OCSP part in the updated SK.

Good to hear it is now part of the mainstream JHF.

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

Danny — Wed, 27 Sep 2017 15:07:30 GMT

In Dameon Welch Abernathy's post also missing for all ThreatEmulation E-Mail users is the following addition to his Notes:

Check your custom postfix modifications after the upgrade.

This JHF GA also includes a known issue with emulation of links in email - sk118280:

It is therefore important to disable “Emulation of links in email” until the TE engine 6.9 (currently EA) is deployed when installing this JHF GA build:

1.vi $FWDIR/conf/mail_security_config

2.add “te_mta_emulate_links_inside_emails=0” under "[mta]" section

3.Save and install policy

4. When TE engine 6.9 is deployed revert the above setting, Save and install policy.

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

PhoneBoy — Wed, 27 Sep 2017 16:09:47 GMT

Thanks for including that important detail.

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

Danny — Wed, 27 Sep 2017 16:24:11 GMT

Yes, I learned it the hard way today. Had to have the virtual.db recreated and everything.

Btw, I like Badges

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

PhoneBoy — Wed, 27 Sep 2017 16:34:53 GMT

You deserve one

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

Norbert_Bohusch — Thu, 28 Sep 2017 08:03:53 GMT

I saw this issue on the MTA of one of my customers and as written in the SK there is also a fix available!

So why not head for the custom fix? Why disable emulation of links-inside-mails instead?

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

Danny — Thu, 28 Sep 2017 08:15:14 GMT

Because adding one line to $FWDIR/conf/mail_security_config is so much quicker to solve the issue when the customer is already suffering instead of contacting Check Point Support to wait for getting a custom built and JHF specific Hotfix for this issue that needs to be requested of each single JHF take and customer environment again. Also you have no dependencies regarding custom Hotfixes installed on top of a JHF takes and therefore much more control about what is actually configured and running on your highly critical firewall system.

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

Norbert_Bohusch — Thu, 28 Sep 2017 08:24:44 GMT

Ok, so I think your solution is a workaround for customers, who don't want to install the hotfix or have to wait for it to be ported for their environment.

Another workaround would be to disable ".com" extension for profile of MTA to be emulated (That's what we did in this case).

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

D_TK — Thu, 28 Sep 2017 19:34:09 GMT

Danny - Has your management CA issue been resolved?

thanks

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

Danny — Thu, 28 Sep 2017 21:28:05 GMT

Not yet. Check Point Support couldn't troubleshoot it on the production system so they are now trying to recreate the issue in their lab which can take a while. I'm currently providing more and more backup / debug files.

Also we encountered a new issue with R77.30 JHF (Take 286) today. If you are using the Giraffe_V2 GA Hotfix for Identity Awareness Agents (pdpd daemon issue), you can't upgrade to Take 286 yet as Giraffe_V2 wasn't integrated into it and can't be installed on top of it and Giraffe_V3 is not available yet nor has an ETA. Only other option is to go straight to R80.10.

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

Tim_Tielens — Fri, 29 Sep 2017 07:33:45 GMT

Yes, i have the same issue.
the threat emulation policy was completely wiped clean, and had to recreate everything.
After creation mails got blocked when passing through threat emulation and MTA.

when an emulation error occurred, valid mails got blocked !

I can concur that "te_mta_emulate_links_inside_emails=0" helped me to disable the option "links inside mails".
Because the option can't be modified from the point where it used to be -> in the TE policy.

Also, smartlog stopped logging after the upgrade and i had to reboot or even do a sic reset for some gateways...

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

Paul_Rutkowski — Fri, 06 Oct 2017 14:03:07 GMT

we installed JBHF286 to 3 clusters 2 gateways and 3 management appliances about a week ago, so far no issues to report.

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

Corey_Christmas — Fri, 06 Oct 2017 16:06:25 GMT

Have you seen any improvements with HTTPS inspection post JBHF286?

Re: R77.30 Take 286: New Jumbo Hotfix GA Release

PhoneBoy — Wed, 11 Oct 2017 05:46:49 GMT

Are you working with TAC on the incompatibility with the Identity Collector hotfix?

For those wondering what we're talking about: Identity Collector - Technical Overview

In general, it's always a good idea to engage with the TAC in a situation where you are using hotfixes that conflict with the current Jumbo Hotfix.