topic Re: SMB Appliances R77.20.81 firmware in Spark Firewall (SMB)

SMB Appliances R77.20.81 firmware

G_W_Albrecht — Wed, 15 May 2019 08:21:40 GMT

As Hristo Grigorov wrote lately in the discussion SFWD process crash, the R77.20.81 firmware is here and it seems that process SFWD is more stable now. But that is not even listed in R77.20.81 firmware Resolved Issues, so i bring here the more obvious news.

What will make many sad is that this and future releases do not support 600/1100 appliances. As End of Support for these is June 2022 and End of Engineering Support is June 2020, R77.20.80 is the last official firmware release for 6x0/11x0 appliances...

But that is not all of the not-so-good news - one of the three additional features is restricted: Multiple WAN interfaces are not supported on 600, 1100, and 1200R appliances. While we would be sure of the first two (as the firmware itself is not supported, too), excluding the 1200R and including only 7x0/14x0/910 models is not very generous ...

Much more helpfull is another addition: Download CA certificate (Portal) for SSL/TLS inspection. Download the gateway CA via the ICA Portal without the need to enter the WebUI. The third one, Blocking Applications and Categories from the SMP, is welcome to Service Providers using SMP portal for managing SMB appliances.

There are even pitfalls to the new WAN IFs: Multiple WAN interfaces are not supported on 730/750/1430/1450 appliances with boot-loader version 82 or older. For more information see sk138912.

Re: SMB Appliances R77.20.81 firmware

PhoneBoy — Mon, 29 Oct 2018 12:11:45 GMT

I don't think we've said that future releases won't support the 600/1100 appliances, only that this particular firmware release does not.

It's entirely possible the multiple WAN port feature requires certain hardware capabilities which may not exist in some of the appliances.

Re: SMB Appliances R77.20.81 firmware

HristoGrigorov — Mon, 29 Oct 2018 13:17:55 GMT

I think you did said just that:

Copy from R77.20.81 for Small and Medium Business Appliances

Important: this and future releases do not support 600/1100 appliances.
The supported appliances are:

700
910
1400
1200R

Re: SMB Appliances R77.20.81 firmware

HristoGrigorov — Mon, 29 Oct 2018 13:22:43 GMT

I am not sure devs know they fixed the sfwd crash, hence why it was not documented. My SR about it is still under investigation. We do not yet know if sfwd crash was bug in the code or some specific appliance setup/usage.

Anyway, sfwd indeed looks more stable now. It still leaks memory but that is something I can live with.

Oh, and checking for new firmware in 77.20.81 is broken:

[sfwd 5408 1737457664]@CPFW-1[29 Oct 14:30:58] sfwd_cloud_run_firmware_upgrade_check: No valid Internet connection.
[sfwd 5408 1737457664]@CPFW-1[29 Oct 14:30:58] sfwd_cloud_update_DB_CFU_status: Updating status to 'FIRMWARE_ONLINE_UPGRADE_STATUS.INTERNET_DISCONNECTED' (code 109)

Both Internet connections are working just fine. I never liked it not being able to disable automatic firmware check so for me this is actually good news

Re: SMB Appliances R77.20.81 firmware

PhoneBoy — Mon, 29 Oct 2018 14:38:01 GMT

I stand corrected then.

The 600/1100 have some hardware limitations that limit the ability to add additional features.

I presume we will still provide bugfixes as needed.

Re: SMB Appliances R77.20.81 firmware

G_W_Albrecht — Mon, 29 Oct 2018 14:46:28 GMT

Yes, bugfixes will be provided until engineering support has ended. But no more official firmware releases will be available for these models...

Re: SMB Appliances R77.20.81 firmware

HristoGrigorov — Mon, 29 Oct 2018 16:30:06 GMT

Out of curiosity what happened to the plans to release R80.20 for SMB ?

Re: SMB Appliances R77.20.81 firmware

PhoneBoy — Mon, 29 Oct 2018 16:52:11 GMT

It's still in the plans but not near-term.

Re: SMB Appliances R77.20.81 firmware

Pedro_Espindola — Mon, 29 Oct 2018 17:38:02 GMT

If I have Bootloader version 75, will the new version R77.20.81 break anything or it only limits the new features I can use?

Re: SMB Appliances R77.20.81 firmware

HristoGrigorov — Mon, 29 Oct 2018 17:48:26 GMT

It will only limit use of FlexiPorts. It should not brake anything.

Re: SMB Appliances R77.20.81 firmware

Pedro_Espindola — Mon, 29 Oct 2018 20:42:56 GMT

Great! Thanks

Re: SMB Appliances R77.20.81 firmware

PhoneBoy — Tue, 20 Nov 2018 23:12:07 GMT

Just to clarify the position on 600/1100 firmware: We will continue to issue 600/1100-specific firmware releases with security, stability, and bug fixes.

They will be separate from releases for the 700/900/1200R/1400 appliances, which often contain new features that do not apply to the 600/1100 due to hardware limitations.

Re: SMB Appliances R77.20.81 firmware

HristoGrigorov — Wed, 21 Nov 2018 04:28:01 GMT

Thanx for the update Dameon.

Now, that we have more or less stable firmware I did some tests and I must say that 1470/1490 series has quite some potential. It can handle quite a lot actually. I hope future firmware releases improve even more on stability and reliability, like fix that memory leaks on policy installs, HTTPS Inspection same as on higher class appliances, GeoPolicy etc.

If I was CheckPoint, I would drop local management for these appliances. Come on, why would I pay the price to have something that has half the capabilities it can?!?

Also, possibility to unlock 4th core on 1470 would be really nice. It kind of disappoints me to know there is a power that is there but cannot be used. And paying the price for a new appliance is just too much expensive. Anyway, we have discussed that already.

A clear roadmap on the future of SMB is also welcome.

Re: SMB Appliances R77.20.81 firmware

Pedro_Espindola — Wed, 21 Nov 2018 12:45:13 GMT

"Why would I pay the price to have something that has half the capabilities it can?"

Because for central management you also have to buy the expensive management.

Plus, the 1400s are good for MSPs because you have the flexibility of using central management or local management with a SMP.

Re: SMB Appliances R77.20.81 firmware

HristoGrigorov — Wed, 21 Nov 2018 17:45:25 GMT

Yeah, I forgot about the SMP. Also Web UI is constantly improved.

Re: SMB Appliances R77.20.81 firmware

G_W_Albrecht — Wed, 05 Dec 2018 13:08:55 GMT

I hate to see such a .... question - it is not important if it is called R77.20.99 or R80.20 ! You can never win a horse race if your cart is pulled by mice .

Re: SMB Appliances R77.20.81 firmware

G_W_Albrecht — Wed, 05 Dec 2018 14:08:38 GMT

sk141512: Checking for a firmware upgrade fails on Small and Medium Business Appliances running R77.20.81 B2525

Re: SMB Appliances R77.20.81 firmware

HristoGrigorov — Thu, 06 Dec 2018 04:13:44 GMT

It is not that bad. If you take away TP blades it can process quite a lot traffic actually (after all it can handle 150K concurrent connections according to vendor). I have similar hardware toys here that do it very well in this respect. But I am talking mostly about 1470/1490 series.

Re: SMB Appliances R77.20.81 firmware

G_W_Albrecht — Fri, 07 Dec 2018 08:43:29 GMT

I i take away TP Blades i will never need R80.20 at all !

Re: SMB Appliances R77.20.81 firmware

SantiagoPlatero — Wed, 12 Dec 2018 15:02:38 GMT

Sorry guys for interject here and bring back to life an old thread, but I'm also very interested in the Check Point's plans for SMB appliances regarding R80... Cause it's not only about the TP blades, we've a handful of others functionalities (for instance Unified Policy, to name a big one) which are only supported for R80.10 gateways and above.

Also, to not only focus on the blades or features: let's think about ICS/SCADA environments... These infrastructures are, more and more, a critical issue for a lot of companies (private or public ones) and Check Point only offer a 1200 rugged appliance, which we don't know if in the future will fall through in comparison to a R80.x Open Server or small enterprise appliance... With the aggravated issue that it's almost impossible to put "normal" servers/appliances (not rugged) in a very controlled environment like where ICS/SCADA equipments are.

So I'm with Hristo Grigorov‌ in here and the I think the request remains: it would be nice for us, as customers, to have a better reassurance from Check Point regarding to the roadmap for SMB and R80 (specially when I'm in plans to replace a R80.10 Open Server for a 1450 appliance, he ).

And I would like to remark the "reassurance" term, as I believe the interest of Check Point to bring major versions upgrades for SMB appliances show to us how Check Point thinks the SMB market.

Again, sorry for bringing back maybe an old discussion... I'm starting to think sometimes I'll perceived here as a forum troll