topic Re: Spark with indicators issue in Spark Firewall (SMB)

Spark with indicators issue

Teddy_CPDC — Tue, 26 Aug 2025 09:01:22 GMT

I have a spark 1600 HA cluster and central managed. firmware version is R81.10.10.

I have indicators feed from firehol level1 and apply on the spark.

After upgrade one appliance to R81.10.17, the spark appliance become offline.

I check the list, it include private IP subnet.

The log on SM show CPD and AMON is deny by indicator list.

Why does the default implied rules not work on R81.10.17?

Re: Spark with indicators issue

Chris_Atkinson — Tue, 26 Aug 2025 10:39:34 GMT

Regarding IOCs does your issue match what is reported here:

https://community.checkpoint.com/t5/SMB-Gateways-Spark/SMB-Upgrade-to-R81-10-17-Build-620-Error-Models-1590-and-1595/m-p/252167

Otherwise please report this through the official TAC channels for further investigation.

https://help.checkpoint.com/

Re: Spark with indicators issue

the_rock — Tue, 26 Aug 2025 12:13:15 GMT

Personally, I would have done exact same thing you did, but if that failed, I would open TAC case as Chris suggested.

Andy

Re: Spark with indicators issue

Teddy_CPDC — Wed, 27 Aug 2025 01:03:31 GMT

Hi,

In this case, the upgrade firmware is R81.10.17 Build 996004653.

Is the step of disable IOC feed also need?

Re: Spark with indicators issue

Chris_Atkinson — Wed, 27 Aug 2025 06:02:47 GMT

The fix was incorporated into that release for the specific issue described there, if you still face issues with that build please update TAC accordingly.