topic Re: Polcy load at boot in Spark Firewall (SMB)

Polcy load at boot

BikeMan — Tue, 14 Jul 2026 08:21:19 GMT

Hello,

May be I am in the wrong section... I will see if I get any answer.

I have an old appliance 14xx still managed by our MDM (yes I know EOL....). Now I have to upgrade MDM to R82.10 and this version is no more supporting 14xx appliances.

If I remove this appliance from the database (or if the MDM/CMA is no more reachable) will the latest policy remain on the appliance ?

What if I reboot this appliance ? It will load the Initial Policy or it will keep the old policy ?

Thanks for your help.

Re: Polcy load at boot

simonemantovani — Tue, 14 Jul 2026 08:34:58 GMT

It should load the latest installed policy.

Re: Polcy load at boot

BikeMan — Tue, 14 Jul 2026 08:53:23 GMT

Thanks for answering.

Also think "it should" but I would prefer "it will". And since hard and soft are EOL, unable to raise a ticket.

Re: Polcy load at boot

Lesley — Tue, 14 Jul 2026 11:14:09 GMT

Now system is central managed, these boxes can also be locally managed. With local mgmt, the rules and logs stay on the local box and you dont need a MDM anymore. Note: CRL check will fail towards mgmt, this is needed for site to site vpn between Check Point to Check Point. CRL check can be disabled.

During reboot it will reach out to mgmt but also during normal operations it will check if there is a new policy and will fetch it. if there is nothing to fetch box will not load a default policy.

Re: Polcy load at boot

emmap — Tue, 14 Jul 2026 12:33:44 GMT

It will work until it doesn't, at which point you won't be able to easily fix it. I think Lesley has the right idea - take the time to properly plan to reset it into Locally Managed mode and do it on your schedule, instead of waiting until it decides you need to do it.

Re: Polcy load at boot

BikeMan — Tue, 14 Jul 2026 12:41:25 GMT

Hi,

Probably I have not been clear enough.

Currently device is running with policy name "policy-from-cma".

Then I do not allow communication with the CMA anymore.

Then rebooting appliance. Is it going to load a local copy of "policy-from-cma" of load the default policy ?

Rgds,

Re: Polcy load at boot

BikeMan — Tue, 14 Jul 2026 13:19:08 GMT

Hi,

Happy to read everybody. But still no answer...

Question is about boot process and policy load. Not about what I should do or not.

Rgds,

Re: Polcy load at boot

simonemantovani — Tue, 14 Jul 2026 13:33:38 GMT

It will load a local copy of "policy-from-cma"

Re: Polcy load at boot

emmap — Tue, 14 Jul 2026 13:39:39 GMT

So, there's kind of two different possible scenarios. If a gateway loses contact with the management server, it will keep on keeping on, retaining the policy on reboot as long as it starts up properly, until something else happens and it doesn't anymore. In your case though, if you delete the gateway from the management server, the gateway will try to talk to it and learn that its SIC cert is revoked. This is less charted waters, most of us won't have tried this scenario, and we don't want to tell you 'yea mate she'll be right' and leave you in the lurch should you suddenly have a with no policy on it. It won't suddenly unload the policy upon learning that its SIC is revoked, but I don't know what it will do on reboot. Hence we offer safer alternatives.

Re: Polcy load at boot

BikeMan — Tue, 14 Jul 2026 13:57:37 GMT

This is the more accurate answer I had. I will deal with it.

Re: Polcy load at boot

PhoneBoy — Tue, 14 Jul 2026 15:37:07 GMT

Even though it's not officially supported, it's quite possible that you will still be able to manage and install policy on your 1400 from R82.10 assuming the object existed prior to the upgrade.
At least that's been the case in the past when we've deprecated support for a given appliance/version as the underlying "Backward Compatibility" packages are still there.